Unable to change the domain when a user is authenticated by SAML

[kiranchavala]

ISSUE TYPE

BUG

COMPONENT NAME

Component: Bug

CLOUDSTACK VERSION

Cloudstack version 4.18.2.5, 4.19.1.3

SUMMARY

Unable to change the domain when a user is authenticated by SAML

Steps to reproduce the issue

On 4.19.1.3 environment

1. Enable SAML authentication
2. Create 2 domains (domain 1 and domain 2)
3. Create Account in each domain and authorize Saml

4. Login as single sign-on

5. Change the domain

6. Exception message

Video recording

https://www.loom.com/share/7dd809008a7649e7907bdf10c56af185?sid=86038cae-f441-4d8f-b76a-0db59486bf0b

---

Followed, the same steps on 4.18.1.1 and found no issue on 4.18.1.1

Video recording

https://www.loom.com/share/6cc8b0625c324976b338965ae679ae26?sid=01b0d96e-5b6d-4d77-bacd-e81c62e66610

Expected Behaviour

Cloudstack saml configured users should be able to change the domain

Actual Behaviour

Cloudstack saml configured users are not able to change the domain

[weizhouapache]

this seems to be regression of security bug fixes in
https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2

there are two related fixes
CVE-2024-45462: Incomplete session invalidation on web interface logout
CVE-2024-45693: Request origin validation bypass makes account takeover possible

[kiranchavala]

Thanks @weizhouapache Saml authenticatied users can change the domain till the 4.18.2.3 release.

The issue is occurring from the 4.18.2.4 release

[weizhouapache]

@kiranchavala
thanks

can you change global setting api.sessionkey.check.locations to CookieOrParameter, and retry ?

[kiranchavala]

@weizhouapache Getting the same error even after changing the api.sessionkey.check.locations to CookieOrParameter

[DaanHoogland]

@weizhouapache @kiranchavala , I set this to 4.20.1 but am having second thoughts. should (and can!) we move this forward or is it too complicated to solve?

[weizhouapache]

@weizhouapache @kiranchavala , I set this to 4.20.1 but am having second thoughts. should (and can!) we move this forward or is it too complicated to solve?

@DaanHoogland
I have not looked into this issue yet, so no idea what's the root cause and how to fix it
IMHO, the fix could be very simple.

@kiranchavala
can SAML user log in with specific domain ? (not switch/change domain)

[kiranchavala]

@weizhouapache

Currently, there is no option to select a specific domain to during login for saml

Once logged in user's get the option to switch to a specific domain

[weizhouapache]

@weizhouapache

Currently, there is no option to select a specific domain to during login for saml

Once logged in user's get the option to switch to a specific domain

thanks @kiranchavala
then this becomes a critical issue for SAML users who has accounts in multiple domains.