github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-27 06:47:02 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

Infinite loop when logging in through IDP without required role #695

New Issue
Closed
opened 2025-11-13 12:08:00 -06:00 by GiteaMirror · 6 comments
GiteaMirror commented 2025-11-13 12:08:00 -06:00
Owner
Copy Link
Copy Source

Originally created by @tim-van-dijkhuizen on GitHub (Sep 25, 2025).

Originally assigned to: @miloschwartz on GitHub.

I have configured an IDP using Keycloak, enabled "Auto Provision Users" and created an organization policy that assigns roles based on the groups claim supplied by Keycloak. Then I enabled "Use Platform SSO" for a resource, allowed access to my Roles and enabled "Auto Login with External IDP".

When logging in with a user that has the right permissions it all works fine no problem. But when a user that does not have the required role tries to login they get stuck in a (seemingly) endless loop of:

  1. Accessing resource exposed by Pangolin
  2. Being redirected to the IDP and logging in, then back to Pangolin
  3. Pangolin refuses the user and redirects back to the IDP
  4. The IDP is already logged in and instantly redirects the user back to Pangolin
  5. The cycle continues

Am I doing something wrong, or is this a bug? Would be great if Pangolin showed an access denied page.

Software info:
Pangolin: v1.9.4
Newt: 1.5.0

I probably should update but looking at the changelog this issue has not been resolved yet.

Originally created by @tim-van-dijkhuizen on GitHub (Sep 25, 2025). Originally assigned to: @miloschwartz on GitHub. I have configured an IDP using Keycloak, enabled "Auto Provision Users" and created an organization policy that assigns roles based on the groups claim supplied by Keycloak. Then I enabled "Use Platform SSO" for a resource, allowed access to my Roles and enabled "Auto Login with External IDP". When logging in with a user that has the right permissions it all works fine no problem. But when a user that does not have the required role tries to login they get stuck in a (seemingly) endless loop of: 1. Accessing resource exposed by Pangolin 2. Being redirected to the IDP and logging in, then back to Pangolin 3. Pangolin refuses the user and redirects back to the IDP 4. The IDP is already logged in and instantly redirects the user back to Pangolin 5. The cycle continues Am I doing something wrong, or is this a bug? Would be great if Pangolin showed an access denied page. **Software info:** Pangolin: v1.9.4 Newt: 1.5.0 I probably should update but looking at the changelog this issue has not been resolved yet.
GiteaMirror added the potential bugbug labels 2025-11-13 12:08:00 -06:00
GiteaMirror commented 2025-11-13 12:08:01 -06:00
Author
Owner
Copy Link
Copy Source

@juanbstevens commented on GitHub (Sep 27, 2025):

I just came across this same issue today.

@juanbstevens commented on GitHub (Sep 27, 2025): I just came across this same issue today.
GiteaMirror commented 2025-11-13 12:08:01 -06:00
Author
Owner
Copy Link
Copy Source

@miloschwartz commented on GitHub (Sep 27, 2025):

Looking into this!

@miloschwartz commented on GitHub (Sep 27, 2025): Looking into this!
GiteaMirror commented 2025-11-13 12:08:01 -06:00
Author
Owner
Copy Link
Copy Source

@keonramses commented on GitHub (Sep 28, 2025):

Thank you for looking into this Milo.

@keonramses commented on GitHub (Sep 28, 2025): Thank you for looking into this Milo.
GiteaMirror commented 2025-11-13 12:08:02 -06:00
Author
Owner
Copy Link
Copy Source

@RJDavison commented on GitHub (Sep 29, 2025):

Same problem with Authentik

@RJDavison commented on GitHub (Sep 29, 2025): Same problem with Authentik
GiteaMirror commented 2025-11-13 12:08:02 -06:00
Author
Owner
Copy Link
Copy Source

@RJDavison commented on GitHub (Sep 29, 2025):

I've figured out why mine was looping. Seems that Pangolin isnt adding the autoprovisioned users to the correct org. Pangolin was putting the Authentik users into a competly differet userspace separate from any org.

I saw that Pangolin was giving the autoprovisioned users a Username that was a long string i.e. "250029b692de7ff504cfe7f435c8223013c64eacefd25ce8fe1fafa1c77f740e". I had to then take this string from "All Users" and is as the username in the org users for it to work. It would then convert the sting to the proper username.

@RJDavison commented on GitHub (Sep 29, 2025): I've figured out why mine was looping. Seems that Pangolin isnt adding the autoprovisioned users to the correct org. Pangolin was putting the Authentik users into a competly differet userspace separate from any org. I saw that Pangolin was giving the autoprovisioned users a Username that was a long string i.e. "250029b692de7ff504cfe7f435c8223013c64eacefd25ce8fe1fafa1c77f740e". I had to then take this string from "All Users" and is as the username in the org users for it to work. It would then convert the sting to the proper username.
GiteaMirror commented 2025-11-13 12:08:02 -06:00
Author
Owner
Copy Link
Copy Source

@miloschwartz commented on GitHub (Oct 8, 2025):

Thanks everyone! I believe I fixed this problem and the fix will be released soon in 1.11.

@miloschwartz commented on GitHub (Oct 8, 2025): Thanks everyone! I believe I fixed this problem and the fix will be released soon in 1.11.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No labels bug potential bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#695