2002482 - SSO bypass - new Firefox Enterprise profile opens unauthenticated browsing window

Status: VERIFIED FIXED

(Firefox Enterprise :: Client, defect)

Description

[Simona Badau, Desktop QA]

Found in

• Firefox Enterprise 147.0a1 - Build ID: 20251126063844

Affected versions

• Firefox Enterprise 147.0a1

Tested platforms

• Affected platforms: Windows 11, macOS 26, Ubuntu 24.04.

Preconditions

• Firefox Enterprise is launched and SSO authentication has completed successfully.

Steps to reproduce

1. Go to Hamburger Menu -> Profiles - New Profile

Expected result

• An additional Firefox Enterprise window should not be launched, and if the Profiles Switching feature is allowed then only the Screen Authentication window should be launched.

Actual result

• A new Firefox Enterprise window for the new profile is launched alongside the Screen Authentication window, and the user can navigate freely without SSO authentication

Regression range

• This is not a regression.

Comment 1

[Dave Townsend [:mossop]]

The profiles feature isn't supported in enterprise right now. I will land a fix to disable it.

Comment 2

[Dave Townsend [:mossop]]

Fixed by https://github.com/mozilla/enterprise-firefox/commit/c351f9b5b8184f6ce3a1b76ee7841cc6c2f90a15

Comment 3

[:gerard-majax]

(In reply to Dave Townsend [:mossop] from comment #2)

Fixed by https://github.com/mozilla/enterprise-firefox/commit/c351f9b5b8184f6ce3a1b76ee7841cc6c2f90a15

It's likely not applied on gcpEU builds because of:

$ git grep firefox-enterprise.js
.github/workflows/enterprise.yml:          echo 'pref("enterprise.console.address", "https://console-gcp-eu.enterfox.eu");' > obj-*/dist/bin/browser/defaults/preferences/firefox-enterprise.js
.github/workflows/enterprise.yml:          echo 'pref("enterprise.console.address", "https://console-gcp-eu.enterfox.eu");' > obj-*/dist/bin/browser/defaults/preferences/firefox-enterprise.js
.github/workflows/enterprise.yml:          echo 'pref("enterprise.console.address", "https://console-gcp-eu.enterfox.eu");' > obj-*/dist/bin/browser/defaults/preferences/firefox-enterprise.js

Comment 4

[:gerard-majax]

Correctly rewriting in https://github.com/mozilla/enterprise-firefox/pull/239

Comment 5

[:gerard-majax]

https://github.com/mozilla/enterprise-firefox/commit/55486752aa3023ef30c8885a7b5c59cb51e2a489

Comment 6

[Simona Badau, Desktop QA]

Verified as fixed - the Profiles Switching feature is now disabled on Firefox Enterprise 148.0a1 (Build ID: 20251217070700) - tested on Windows 11 and Ubuntu 24.04.