github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-08 13:49:15 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #1540] Infinite loop when logging in through IDP without required role #1948

New Issue
Closed
opened 2026-04-16 08:49:46 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-16 08:49:46 -05:00
Owner
Copy Link

Originally created by @tim-van-dijkhuizen on GitHub (Sep 25, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1540

Originally assigned to: @miloschwartz on GitHub.

I have configured an IDP using Keycloak, enabled "Auto Provision Users" and created an organization policy that assigns roles based on the groups claim supplied by Keycloak. Then I enabled "Use Platform SSO" for a resource, allowed access to my Roles and enabled "Auto Login with External IDP".

When logging in with a user that has the right permissions it all works fine no problem. But when a user that does not have the required role tries to login they get stuck in a (seemingly) endless loop of:

  1. Accessing resource exposed by Pangolin
  2. Being redirected to the IDP and logging in, then back to Pangolin
  3. Pangolin refuses the user and redirects back to the IDP
  4. The IDP is already logged in and instantly redirects the user back to Pangolin
  5. The cycle continues

Am I doing something wrong, or is this a bug? Would be great if Pangolin showed an access denied page.

Software info:
Pangolin: v1.9.4
Newt: 1.5.0

I probably should update but looking at the changelog this issue has not been resolved yet.

Originally created by @tim-van-dijkhuizen on GitHub (Sep 25, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1540 Originally assigned to: @miloschwartz on GitHub. I have configured an IDP using Keycloak, enabled "Auto Provision Users" and created an organization policy that assigns roles based on the groups claim supplied by Keycloak. Then I enabled "Use Platform SSO" for a resource, allowed access to my Roles and enabled "Auto Login with External IDP". When logging in with a user that has the right permissions it all works fine no problem. But when a user that does not have the required role tries to login they get stuck in a (seemingly) endless loop of: 1. Accessing resource exposed by Pangolin 2. Being redirected to the IDP and logging in, then back to Pangolin 3. Pangolin refuses the user and redirects back to the IDP 4. The IDP is already logged in and instantly redirects the user back to Pangolin 5. The cycle continues Am I doing something wrong, or is this a bug? Would be great if Pangolin showed an access denied page. **Software info:** Pangolin: v1.9.4 Newt: 1.5.0 I probably should update but looking at the changelog this issue has not been resolved yet.
GiteaMirror added the potential bugbug labels 2026-04-16 08:49:46 -05:00
GiteaMirror commented 2026-04-16 08:49:49 -05:00
Author
Owner
Copy Link

@juanbstevens commented on GitHub (Sep 27, 2025):

I just came across this same issue today.

<!-- gh-comment-id:3341078304 --> @juanbstevens commented on GitHub (Sep 27, 2025): I just came across this same issue today.
GiteaMirror commented 2026-04-16 08:49:50 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Sep 27, 2025):

Looking into this!

<!-- gh-comment-id:3341941888 --> @miloschwartz commented on GitHub (Sep 27, 2025): Looking into this!
GiteaMirror commented 2026-04-16 08:49:51 -05:00
Author
Owner
Copy Link

@keonramses commented on GitHub (Sep 28, 2025):

Thank you for looking into this Milo.

<!-- gh-comment-id:3344288499 --> @keonramses commented on GitHub (Sep 28, 2025): Thank you for looking into this Milo.
GiteaMirror commented 2026-04-16 08:49:52 -05:00
Author
Owner
Copy Link

@RJDavison commented on GitHub (Sep 29, 2025):

Same problem with Authentik

<!-- gh-comment-id:3347655958 --> @RJDavison commented on GitHub (Sep 29, 2025): Same problem with Authentik
GiteaMirror commented 2026-04-16 08:49:53 -05:00
Author
Owner
Copy Link

@RJDavison commented on GitHub (Sep 29, 2025):

I've figured out why mine was looping. Seems that Pangolin isnt adding the autoprovisioned users to the correct org. Pangolin was putting the Authentik users into a competly differet userspace separate from any org.

I saw that Pangolin was giving the autoprovisioned users a Username that was a long string i.e. "250029b692de7ff504cfe7f435c8223013c64eacefd25ce8fe1fafa1c77f740e". I had to then take this string from "All Users" and is as the username in the org users for it to work. It would then convert the sting to the proper username.

<!-- gh-comment-id:3348304862 --> @RJDavison commented on GitHub (Sep 29, 2025): I've figured out why mine was looping. Seems that Pangolin isnt adding the autoprovisioned users to the correct org. Pangolin was putting the Authentik users into a competly differet userspace separate from any org. I saw that Pangolin was giving the autoprovisioned users a Username that was a long string i.e. "250029b692de7ff504cfe7f435c8223013c64eacefd25ce8fe1fafa1c77f740e". I had to then take this string from "All Users" and is as the username in the org users for it to work. It would then convert the sting to the proper username.
GiteaMirror commented 2026-04-16 08:49:53 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Oct 8, 2025):

Thanks everyone! I believe I fixed this problem and the fix will be released soon in 1.11.

<!-- gh-comment-id:3383223925 --> @miloschwartz commented on GitHub (Oct 8, 2025): Thanks everyone! I believe I fixed this problem and the fix will be released soon in 1.11.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label bug potential bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#1948
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?