SAML Login Provider

saml-login-provider 1.1.0 brings the modified login page to the editing host, makes it work end to end with Google, and lets each site set its own sign-in button text.

What's new

• Hosts no site declares fall back to systemsite. A host that no site declares, typically the editing host (edit.example.com), now follows systemsite's settings: the modified login page as soon as the module is enabled on systemsite and systemsite has SAML set up, and straight SAML once the host is in systemsite's list. Only systemsite may list such hosts. Hosts shared by several sites still keep the standard login.
• Per-site sign-in button text. A new Sign-in button text field in each site's SAML auto-login screen sets the text of the login page's SAML button. Empty keeps the default "Sign in with Google", shown in each visitor's language; a custom text (plain text, up to 80 characters) is the same in every language.
• /tools and other core-protected pages get the modified login page. Jahia protects /tools, /modules/tools, *.raw and /cms/serverStats with its own login redirect to /cms/login, which never consulted this module. A visit to /cms/login now goes on to the modified login page (or straight to SAML on a listed host) wherever the module acts, keeping the page asked for.

Fixes

• Back to the page you asked for after a Google login. The SAML valve keeps the post-login target in a cookie that browsers didn't send back on Google's cross-site return, so users landed on the site's home page. The module now sends that cookie with SameSite=None; Secure over HTTPS (directly or behind a proxy setting X-Forwarded-Proto: https).
• No more server error on the first page after a SAML login to /tools. Landing directly on a Shiro-protected page made Jahia fail that first request (InvalidSessionException, fine after a reload; a core issue). SAML logins now return through a short /saml-login-return hop where Jahia completes the login, then go on to the page.

Upgrading from 1.0.0

Nothing changes for sites that already work. To use the editing-host fallback, give systemsite a SAML connector that names it on the way back, with its URLs on the editing host:

# karaf/etc/org.jahia.modules.auth-systemsite.cfg (or systemsite's Authentication settings) Saml.serverLocation = https://edit.example.com Saml.incomingTargetUrl = /home.callback.saml?siteKey=systemsite

The IdP must accept that callback URL for systemsite's relying party. GraphQL is backward compatible: update(siteKey, fqdn) without the new buttonLabel argument keeps the current text.

Requirements

• Jahia 8.2
• jahia-authentication 2.1.0, a declared dependency. The SAML connector itself comes from saml-authentication-valve 4.x (with jcr-auth-provider 4.x for the user mapping), configured on each site that should use SAML.

Install

Upload saml-login-provider-1.1.0.jar in Administration → Server settings → Modules (it replaces 1.0.0), enable the module on the sites that should use it, then set each site's list and button text in its SAML auto-login screen.

Quality

• Unit tests: 301 pass.
• SonarQube: quality gate OK, 0 open issues, 96 % coverage.
• Cypress: 31/31, including full login round trips through a real Keycloak SAML IdP, on a site's own host and on a host no site declares.
• Security reviews: each change was reviewed independently; the findings are fixed.

Full changelog: 1_0_0...1_1_0

What it does

On a site where the module is enabled and that has SAML authentication set up (an enabled saml-authentication-valve connector):

• A host in the site's list goes straight to the SAML connect endpoint (/home.connect.saml), with no login form. Logout lands on a public page, so it isn't undone by a silent SAML re-login.
• Any other host of the site, including every host when the list is empty, gets /saml-login: the standard credentials form plus a "Sign in with Google" button.

Everywhere else Jahia's standard login is untouched: a site where the module isn't enabled, a site with no SAML connector, or a host that resolves to no single site. Because a host is only redirected when its site has a working target, a misconfigured list can't lock visitors out.

Configuration

• Where: each site's administration, at Administration → site → SAML auto-login (/jahia/administration/<siteKey>/samlLoginProvider). The screen shows the site's own host names and warns when the site has no SAML connector.
• Permission: siteAdminSamlLoginProvider, checked on the site. An admin of one site can't change how any other site logs its visitors in.
• Accepted hosts: only the site's own server name and aliases, and only those that no other site also declares.
• Storage: one file per site, karaf/etc/org.jahia.community.samlloginprovider.site-<siteKey>.cfg.
• GraphQL: samlLoginProvider { config(siteKey) / update(siteKey, fqdn) }.

Requirements

• Jahia 8.2
• jahia-authentication 2.1.0, a declared dependency. The SAML connector itself comes from saml-authentication-valve 4.x (with jcr-auth-provider 4.x for the user mapping), configured on each site that should use SAML.

Install

Upload saml-login-provider-1.0.0.jar in Administration → Server settings → Modules, enable the module on the sites that should use it, then set each site's list in its SAML auto-login screen.

Quality

• Unit tests: 164 pass.
• SonarQube: quality gate OK, 0 open issues, 96 % coverage.
• Cypress: 19/19, including a full login round trip through a real Keycloak SAML IdP.
• Security reviews: the per-site authorization model was reviewed, and the findings are fixed.