The togglz console has no logout button. Is it possible to add one?
context: I have an api secured with keycloak, i've added togglz console, which means i had to create a separate securityconfig with an order prior to keycloak's config.
TogglzSecurityConfig a simple inmemoryAuthentication ORDER(1)
KeycloakSecurityConfig ORDER(2)
Everything is working fine but once i'm connected to the console, there is no way to logout.
Related
I'm trying to migrate to the new Sign In With Google and I'm missing one crucial functionality I was using previously.
Basicly my application is working with locally created application users. At one point in the application, the user is prompted to login with Google Account to confirm that he's the correct user that will do some Google API action. I was able to achieve that with following code from the soon deprecated Google Sign-In library:
const auth = gapi.auth2.getAuthInstance();
if (!auth.isSignedIn.get())
await auth.signIn({
prompt: "select_account",
login_hint: employeeEmail
});
...
And it worked just fine. Now all the above methods are being deprecated and there are no direct replacements, or at least I don't understand how to achieve the same result. I am able to confirm the user identity by checking the id token received by using:
google.accounts.id.initialize({/*options*/);
...
google.accounts.id.prompt();
But if there's no google session active for the user, nothing happens.
The only way to actually trigger the Sign In is to click the Google Sign In Button, rendered using:
google.accounts.id.renderButton(htmlElement, {/*options*/});
After the button is clicked, the sign in popup is shown and everything is fine, the callback of the initialize configuration is called and the flow is resumed.
The problem is, how do I trigger the Sign In popup programatically? All of the above starts with a specific button click on my website.
FYI
I actually managed to reproduce almost the same behavior with the new API. It might not be the most elegant way of doing this, but I replaced the signIn method from my post above with google.accounts.oauth2.initTokenClient. Even though it should be used to only receive the tokens, it will also create a valid Google session that then can be detected by using silent auth (prompt: "none");
The google sign in button doesn't render unless I use the google.accounts.id.initialize() method. However to use the authorization code flow I need to use create and use a CodeClient by calling google.accounts.oauth2.initCodeClient() and then manually call a .prompt() method on this client object.
So I can't see how I am meant to have the user click on the sign in button and then start an authorization code flow without having the user have to deal with two separate popup windows. The first to authenticate themselves and the second to authorize the back end service.
Additional context:
This is a single page application
I am using my own back end service
Google sign in is the only authentication option available
How to use firebaseui-web autoUpgradeAnonymousUsers?
Situation:
Before a user is signed-in / logged in, this page could be rendered. However, after a user is signed, I could no longer display this page using the same sample code as https://github.com/firebase/firebaseui-web.
I have set autoUpgradeAnonymousUser: true. So what are the steps to use autoUpgradeAnonymousUser. It is not available in the demo app source code.
Before rendering FirebaseUI, you could call firebase.auth().signInAnonymously() to sign in on the Auth instance. And then pass the Auth instance to firebaseUI instance. If autoUpgrade config is turned on, when user click sign-in buttons, it would trigger the account linking to link google/facebook/password account to your anonymous account. However, you need to provide the SignInFailure callback in case there is merge conflict. Here you can find more detail and code sample: https://github.com/firebase/firebaseui-web#upgrading-anonymous-users
I have two meteor apps. one will have all the users data and the other is just a client app which handles some processing and exchanges data with the server app. the server app also have some user interface.
I have two problems with this configuration:
First one is I want to login from the client app but using meteor.users database stored in the server app. I read about AccountsCommon but I can't get the sense of how to make a login ui which uses the AccountsClient. I tried for example to create AccountsClient at template loading with this line:
Template.hello.onCreated(function helloOnCreated() {
...
accountObj = new AccountsClient({ddpUrl: "http://server-url"})
...
}
Then I tried to use it with accounts-ui call in my template html file:
{{> loginButtons}}
What I don't know is how to configure accounts-ui with the client object I created.
Second one is that what I want to do after fixing the first problem is to allow a user who is logged in from the server-app user interface to be redirected to the client-app without them needing to login again. i.e. (you click a button at the server-app that redirects you to the client-app and you're still logged-in in the client app).
I changed my code from calling on this function: wp_logout_url() when the logout button is clicked, to just calling www.mysite.com/access?action=logout.
Users could log out and they get a prompt before they do but is there any vulnerabilities letting users log out of the website this way? Rather than using wp_logout_url()?