{"action":"created","issue":{"url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/529","labels_url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/529/labels{/name}","comments_url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/529/comments","events_url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/529/events","html_url":"https://github.com/edx-solutions/edx-platform/pull/529","id":106906857,"number":529,"title":"Custom SSO entry points","user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-09-17T03:43:59Z","updated_at":"2015-09-23T07:21:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/edx-solutions/edx-platform/pulls/529","html_url":"https://github.com/edx-solutions/edx-platform/pull/529","diff_url":"https://github.com/edx-solutions/edx-platform/pull/529.diff","patch_url":"https://github.com/edx-solutions/edx-platform/pull/529.patch"},"body":"This PR makes a simple change to `third_party_auth` so that we can configure \"custom auth entry points\" on a server. This basically means we can have a custom URL acting as the login/register page, and it will be correctly integrated with the SSO pipeline. It can be an internal URL that's part of the LMS or an external URL.\r\n\r\nThis PR also tweaks the solutions server API so that we can login a user by \"upgrading\" their existing anonymous session rather than creating a new session. This is required to preserve the third_party_auth pipeline during SSO logins.\r\n\r\n**JIRA**: This is part of [YONK-81](https://openedx.atlassian.net/browse/YONK-81)\r\n\r\n**Target**: For now I am intending this to be **solutions-only** and not necessarily going upstream.\r\n\r\n**Example**:\r\n\r\nFirst, one would configure a custom auth entry point called `marketing` in `lms.auth.json`:\r\n\r\n```\r\n    \"THIRD_PARTY_AUTH_CUSTOM_AUTH_FORMS\": {\r\n        \"marketing\": {\"key\": \"opensesame\", \"url\": \"http://marketing.mylms.com/sso-login\"}\r\n    }\r\n```\r\n\r\nThen one can send users to `/auth/login/:provider/?auth_entry=marketing&next=/final/url`. Users will then be prompted to login to their provider, then redirected to the `url` set in `THIRD_PARTY_AUTH_CUSTOM_AUTH_FORMS['marketing']`. (It is important that this parameter is configured via settings and not via the URL, to avoid attacks where users are given a malicious URL that leads them to fill out fake registration forms that submit data to a third party).\r\n\r\nThe custom login/register page can then do whatever it wants in terms of logging in / registering the user, and it will get the user's basic information (username, email, name, etc.) passed as POST data and signed with a message authentication code. Finally, the custom login/register page must send the user to `/auth/complete/:provider/` to finish the SSO process and link the user's account to the provider.\r\n\r\n**Reviewers**\r\n\r\n@e-kolpakov and TBD"},"comment":{"url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/comments/142518092","html_url":"https://github.com/edx-solutions/edx-platform/pull/529#issuecomment-142518092","issue_url":"https://api.github.com/repos/edx-solutions/edx-platform/issues/529","id":142518092,"user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"created_at":"2015-09-23T07:21:01Z","updated_at":"2015-09-23T07:21:01Z","body":"@mattdrayer Is there any chance you'd be able to review this today? (The change to the sessions API in particular)"}}