fix: allow non-enterprise, saml users to complete registration in authn MFEFix: Redirect non-enterprise SAML to authn MFE #35917
+3
−10
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
PR #27431 included a condition that was ment to prevent enterprise users with tpa-hint enabled and coming from SAML IdP to be redirected to the authn MFE, as it "doesn't support a co-branded login/register screen with the enterprise customer (e.g., enterprise logo, custom messaging, etc.)."
However the condition also prevented non-enterprise, SAML users to be redirected to the authn MFE.
Supporting information
It was discussed in a slack conversation.
Testing instructions
To test this use case:
Tests run as part of PR #27431 should also pass:
Enterprise customer with tpa-hint and SAML IdP should be redirected to the legacy registration page.
Deadline
ASAP.
Other information
We happen to have a client that requested SAML authentication, and a number of customizations in the authn MFE including custom fields. Users are then redirected to the legacy register page, which is based on Backbone. These pages are not theme-able, so porting the customizations is extremely complex and not scalable.