Feature | Integrate auto-login at legacy.openstack.org by checking www.openstack.org localStorage

[matiasperrone-exo]

Summary

Task request:

repo

https://github.com/OpenStackweb/openstack-org

We want users that are already authenticated at the shell app (www.openstack.org) to be automatically recognized and logged in when they navigate to legacy.openstack.org (SilverStripe 2.x). Since both apps are reverse-proxied under the same origin (www.openstack.org), the legacy pages can read localStorage values set by the shell.

1. On initial page load, legacy should run a JS bootstrap that:

Reads localStorage.authinfo (accessToken, idToken, expiresIn, etc.).

Skips if no token or if expired.

Posts the tokens to a new secure endpoint on legacy (POST /oidc/session/bootstrap).

if return 204 reload the page to reflect login state.

2. Server Endpoint (/oidc/session/bootstrap)

Accepts only POST JSON requests with:

Authorization: Bearer header.

X-CSRF-Token header (double-submit cookie).

Validates the access token via IdP (JWT signature / introspection).

Maps a SilverStripe Member.

Calls $member->logIn() and rotates session ID.

Responds with 204 No Content on success.

dev notes

• server endpoint should implement an instrospection request to IDP so we should need a new resource server at idp config

check here for reference https://github.com/OpenStackweb/summit-api/blob/ce76543fe712e7f20e10752470aebf0792c64b90/app/Models/ResourceServer/AccessTokenService.php#L134

• Endpoints enforce CSRF (double-submit cookie), same-origin (Origin/Referer + Sec-Fetch-Site), POST + JSON only, no CORS.

• Feature is behind SHELL_SSO_BOOTSTRAP_ENABLED. feature flag

Changes

Testing

Related Issues

• https://tipit.avaza.com/task#task=3855829

[smarcet]

@matiasperrone-exo please review comments