{"action":"created","issue":{"url":"https://api.github.com/repos/edx/edx-platform/issues/9903","labels_url":"https://api.github.com/repos/edx/edx-platform/issues/9903/labels{/name}","comments_url":"https://api.github.com/repos/edx/edx-platform/issues/9903/comments","events_url":"https://api.github.com/repos/edx/edx-platform/issues/9903/events","html_url":"https://github.com/edx/edx-platform/pull/9903","id":108077924,"number":9903,"title":"Allow using a custom login/register form with third_party_auth","user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-24T07:52:41Z","updated_at":"2015-12-01T04:01:04Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/edx/edx-platform/pulls/9903","html_url":"https://github.com/edx/edx-platform/pull/9903","diff_url":"https://github.com/edx/edx-platform/pull/9903.diff","patch_url":"https://github.com/edx/edx-platform/pull/9903.patch"},"body":"This PR makes a simple change to `third_party_auth` so that we can configure \"custom auth entry points\" on a server. This basically means we can have a custom URL acting as the login/register page, and it will be correctly integrated with the SSO pipeline. It can be an internal URL that's part of the LMS or an external URL.\r\n\r\nThis feature was developed for the solutions fork. To see a detailed specific use case, check out the solutions PR linked below and PR 1189 in the private Apros repository. I am contributing this upstream now to minimize code drift and because it may be useful for others.\r\n\r\n**Solutions PR**: https://github.com/edx-solutions/edx-platform/pull/529\r\n\r\n**Timeline**: No particular deadline\r\n\r\n**Example**:\r\n\r\nFirst, one would configure a custom auth entry point called `marketing` in `lms.auth.json`:\r\n\r\n```\r\n    \"THIRD_PARTY_AUTH_CUSTOM_AUTH_FORMS\": {\r\n        \"marketing\": {\"secret_key\": \"opensesame\", \"url\": \"http://marketing.mylms.com/sso-login\"}\r\n    }\r\n```\r\n\r\nThen one can send users to `/auth/login/:provider/?auth_entry=marketing&next=/final/url`. Users will then be prompted to login to their provider, then redirected to the `url` set in `THIRD_PARTY_AUTH_CUSTOM_AUTH_FORMS['marketing']`. (It is important that this parameter is configured via settings and not via the URL, to avoid attacks where users are given a malicious URL that leads them to fill out fake registration forms that submit data to a third party).\r\n\r\nThe custom login/register page can then do whatever it wants in terms of logging in / registering the user, and it will get the user's basic information (username, email, name, etc.) passed as POST data and signed with a message authentication code. Finally, the custom login/register page must send the user to `/auth/complete/:provider/` to finish the SSO process and link the user's account to the provider.\r\n\r\n**Sandbox**: http://pr9903.sandbox.opencraft.com/\r\n\r\n**Test Instructions**:\r\nGo to http://pr9903.sandbox.opencraft.com/auth/login/dummy/?auth_entry=marketing&next=/final/url in an incognito window. The dummy provider will not prompt for a password but instead simulates an SSO login. You should be directed to the custom login URL specified for \"marketing\" in the settings: `/login?this-is-a-custom-url-example`.\r\n\r\n**Reviewers**\r\n\r\n@e-kolpakov and TBD\r\n\r\n**Settings**\r\n```yaml\r\nEDXAPP_FEATURES:\r\n  ENABLE_THIRD_PARTY_AUTH: true\r\nEDXAPP_ENV_EXTRA:\r\n  THIRD_PARTY_AUTH_BACKENDS: [\"third_party_auth.dummy.DummyBackend\"]\r\nEDXAPP_AUTH_EXTRA:\r\n  THIRD_PARTY_AUTH_CUSTOM_AUTH_FORMS:\r\n    marketing: {\"secret_key\": \"opensesame\", \"url\": \"/login?this-is-a-custom-url-example\"}\r\n```"},"comment":{"url":"https://api.github.com/repos/edx/edx-platform/issues/comments/160845265","html_url":"https://github.com/edx/edx-platform/pull/9903#issuecomment-160845265","issue_url":"https://api.github.com/repos/edx/edx-platform/issues/9903","id":160845265,"user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"created_at":"2015-12-01T04:01:04Z","updated_at":"2015-12-01T04:01:04Z","body":"jenkins run python"}}