Documentation related to reauthentication by SebSept · Pull Request #217 · glpi-project/docdev

SebSept · 2026-07-30T14:44:28Z

No description provided.

New devapi/reauthentication page: - architecture: ReAuthManager, ReAuthStrategyInterface, InPlaceReAuthStrategy, native strategies and their priorities, request flow and session keys - how to protect a page or an action: itemTypeRequiresReauthentication(), check()/checkGlobal()/checkReAuthenticationOrRedirect(), the $reauth_needed by-reference flag, AJAX endpoints, massive actions - how a plugin provides a strategy: registerStrategy(), in-place strategy, remote (out-of-band) strategy overriding getVerifyUrl(), prompt template - development and testing: GLPI_DISABLE_REAUTH, --group reauth, ReAuthTrait, Playwright/Cypress helpers Cross-references added from acl, controllers, massiveactions, plugins/objects and plugins/controllers pages.

New plugins/reauthentication page holding what a plugin developer needs: registerStrategy(), in-place strategy, prompt template, remote (out-of-band) strategy and its verify endpoint, security considerations, examples. devapi/reauthentication keeps the architecture and how to protect a page, and now only points to the plugins page for the strategy recipe.

Rom1-B · 2026-07-31T13:22:24Z

+.. code-block:: php
+
+   <?php
+


Maybe add use statements?

Suggested change

use Glpi\Controller\AbstractController;

use Glpi\Exception\Http\AccessDeniedHttpException;

use Glpi\Security\ReAuth\ReAuthManager;

use Symfony\Component\HttpFoundation\Response;

use Symfony\Component\Routing\Attribute\Route;

Rom1-B · 2026-07-31T13:31:38Z

+A plugin can contribute its own verification method — typically an OAuth/SSO plugin verifying
+the identity through the identity provider. Registered strategies are merged with the native
+ones and take part in the same priority-based selection: ``ReAuthManager::registerStrategy()``
+is where it starts.
+
+A plugin supplies only the *how* of verifying the identity. It cannot change the window
+duration, nor which itemtypes are sensitive.
+
+See :doc:`/plugins/reauthentication` for the whole recipe: registering the strategy,
+implementing an in-place one, providing the prompt template, and delegating the verification to
+an external service.


The "how a plugin registers a strategy" paragraph duplicates content already explained in plugins/reauthentication.rst:27-28 (registered strategies merged with native ones, same priority-based selection). The core page only needs the entry point and the pointer to the full recipe.

Suggested change

A plugin can contribute its own verification method — typically an OAuth/SSO plugin verifying

the identity through the identity provider. Registered strategies are merged with the native

ones and take part in the same priority-based selection: ``ReAuthManager::registerStrategy()``

is where it starts.

A plugin supplies only the *how* of verifying the identity. It cannot change the window

duration, nor which itemtypes are sensitive.

See :doc:`/plugins/reauthentication` for the whole recipe: registering the strategy,

implementing an in-place one, providing the prompt template, and delegating the verification to

an external service.

A plugin can contribute its own verification method (typically an OAuth/SSO plugin verifying

the identity through the identity provider) via ``ReAuthManager::registerStrategy()``. It

supplies only the *how* of verifying the identity: it cannot change the window duration, nor

which itemtypes are sensitive.

See :doc:`/plugins/reauthentication` for the whole recipe: registering the strategy,

implementing an in-place one, providing the prompt template, and delegating the verification to

an external service.

Rom1-B · 2026-07-31T13:33:08Z

+Session keys used
+++++++++++++++++
+
+``glpi_reauth_until`` (expiration timestamp), ``glpi_reauth_requested_url``,
+``glpi_reauth_requested_httpmethod``, ``glpi_reauth_requested_post_data``,
+``glpi_reauth_origin_url``.


The session keys are listed as a run-on sentence; every other multi-item enumeration in this page (native strategies, protected itemtypes) uses a table or list. A list-table would be easier to scan here too.

Suggested change

Session keys used

+++++++++++++++++

``glpi_reauth_until`` (expiration timestamp), ``glpi_reauth_requested_url``,

``glpi_reauth_requested_httpmethod``, ``glpi_reauth_requested_post_data``,

``glpi_reauth_origin_url``.

.. list-table::

:header-rows: 1

:widths: 40 60

* - Session key

- Holds

* - ``glpi_reauth_until``

- Expiration timestamp of the current window.

* - ``glpi_reauth_requested_url``

- The URL to replay once verified.

* - ``glpi_reauth_requested_httpmethod``

- The HTTP method of the replayed request.

* - ``glpi_reauth_requested_post_data``

- The POST data of the replayed request.

* - ``glpi_reauth_origin_url``

- The referer, used for the "Cancel" button.

Rom1-B · 2026-07-31T13:36:54Z

+When the identity is verified by an external service (OAuth/SSO, an external MFA provider…),
+override ``getVerifyUrl()`` — and possibly ``getVerifyHttpMethod()`` — to point at one of your
+own routes:


The out-of-band strategy section jumps straight to "override getVerifyUrl()" without stating that the plugin's own route then owns the whole flow (verification, opening the window, replaying the request) — unlike the in-place strategy section above it, which spells this out.

Suggested change

When the identity is verified by an external service (OAuth/SSO, an external MFA provider…),

override ``getVerifyUrl()`` — and possibly ``getVerifyHttpMethod()`` — to point at one of your

own routes:

When the identity is verified by an external service (OAuth/SSO, an external MFA provider…), the

plugin's own route takes over the whole flow: verifying the identity, opening the

re-authentication window, and replaying the initial request. To do this, override

``getVerifyUrl()`` — and possibly ``getVerifyHttpMethod()`` — to point at one of your own routes:

SebSept added 2 commits July 30, 2026 16:42

SebSept requested review from Rom1-B and froozeify July 30, 2026 14:45

Rom1-B requested a review from stonebuzz July 31, 2026 10:04

Rom1-B reviewed Jul 31, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Documentation related to reauthentication - #217

Documentation related to reauthentication#217
SebSept wants to merge 2 commits into
glpi-project:masterfrom
SebSept:sudo_doc

SebSept commented Jul 30, 2026

Uh oh!

Rom1-B Jul 31, 2026

Uh oh!

Rom1-B Jul 31, 2026

Uh oh!

Rom1-B Jul 31, 2026

Uh oh!

Rom1-B Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

+   use Glpi\Controller\AbstractController;
+   use Glpi\Exception\Http\AccessDeniedHttpException;
+   use Glpi\Security\ReAuth\ReAuthManager;
+   use Symfony\Component\HttpFoundation\Response;
+   use Symfony\Component\Routing\Attribute\Route;

-Session keys used
-+++++++++++++++++
-``glpi_reauth_until`` (expiration timestamp), ``glpi_reauth_requested_url``,
-``glpi_reauth_requested_httpmethod``, ``glpi_reauth_requested_post_data``,
-``glpi_reauth_origin_url``.
+.. list-table::
+   :header-rows: 1
+   :widths: 40 60
+   * - Session key
+     - Holds
+   * - ``glpi_reauth_until``
+     - Expiration timestamp of the current window.
+   * - ``glpi_reauth_requested_url``
+     - The URL to replay once verified.
+   * - ``glpi_reauth_requested_httpmethod``
+     - The HTTP method of the replayed request.
+   * - ``glpi_reauth_requested_post_data``
+     - The POST data of the replayed request.
+   * - ``glpi_reauth_origin_url``
+     - The referer, used for the "Cancel" button.

-When the identity is verified by an external service (OAuth/SSO, an external MFA provider…),
-override ``getVerifyUrl()`` — and possibly ``getVerifyHttpMethod()`` — to point at one of your
-own routes:
+When the identity is verified by an external service (OAuth/SSO, an external MFA provider…), the
+plugin's own route takes over the whole flow: verifying the identity, opening the
+re-authentication window, and replaying the initial request. To do this, override
+``getVerifyUrl()`` — and possibly ``getVerifyHttpMethod()`` — to point at one of your own routes:

Uh oh!

Conversation

SebSept commented Jul 30, 2026

Uh oh!

Rom1-B Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Rom1-B Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Rom1-B Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Rom1-B Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants