1620018 - Broken redirect for SAML authentication with Zoom client

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect, P2)

Description

[Mark Richards [:freshness]]

Attachment: Screen Shot 2020-03-04 at 6.04.49 PM.jpg

Firefox Nightly 75.0a1 (2020-03-02) and 75.0a1 (2020-03-03)
Nighlty Debugger notes: csrf_js:87:23

When Nightly is set as the default browser, SSO login with the Zoom conferencing client redirects to the profile page, but fails to launch the Zoom client and pass the authentication token.

Comment 1

[Dave Townsend [:mossop]]

I doubt the message about synchronous XMLHttpRequest being deprecated is relevant. We have been logging that message for six years and even though deprecated it still works.

What are the steps to reproduce this?

Comment 2

[Dave Townsend [:mossop]]

I managed to reproduce this and mozregression got me the range https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a14a131ca73171c6aab469abefb9db79120e056a&tochange=150b8347d28f8a05bddd6cd9ea4b7851490639a1 so I suspect that bug 1604212 caused this.

Comment 3

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Note that this also affects the "Zoom Scheduler" add-on.

Comment 4

[Andrea Marchesini [:baku]]

We should contact zoom and ask them to set sameSite=none to their cookies. Peter, is it something you can help with?

Comment 5

[zoltan.nyikos]

Seems like it also broke GSuite SAML login into DataDog, tried mozregression, it resulted in the same commits as the one linked above.

Comment 6

[Daniel Kolsis]

Based on Comment 2 I will set firefox74 and firefox73 flags to unaffected. Dave, in case this is incorrect please switch the statuses as to your liking.

Comment 7

[j.j.]

Should this block meta bug 1618610 ?

Comment 8

[Peter Saint-Andre [:stpeter]]

:baku I did contact Zoom about this. I'll update this bug once we receive a definitive reply.

Comment 10

[Peter Saint-Andre [:stpeter]]

I've re-pinged our friends at Zoom about this.

Comment 11

[Mark Richards [:freshness]]

This bug has popped up again with the Zoom client on Nightly 84.0a1.
Update Reporter was using Containers which was blocking the SAML redirect.
Using a fresh profile allowed the user to log in successfully. False alarm!

Comment 12

[Valentin Gosu [:valentin] (he/him)]

(In reply to Mark Richards [:freshness] from comment #11)

Using a fresh profile allowed the user to log in successfully. False alarm!