FR: SAML Sign In - Interstitial page to send users directly to IdP login screen

chrome/browser/resources/gaia_auth_host/authenticator.js

Index: chrome/browser/resources/gaia_auth_host/authenticator.js
diff --git a/chrome/browser/resources/gaia_auth_host/authenticator.js b/chrome/browser/resources/gaia_auth_host/authenticator.js
index 2407ffa35822773b9212cfb3091c74cb18eeb99d..de6fb550b003d7c2305eacd81918b4053ea9975d 100644
--- a/chrome/browser/resources/gaia_auth_host/authenticator.js
+++ b/chrome/browser/resources/gaia_auth_host/authenticator.js
@@ -31,6 +31,7 @@ cr.define('cr.login', function() {
   var GAPS_COOKIE = 'GAPS';
   var SERVICE_ID = 'chromeoslogin';
   var EMBEDDED_SETUP_CHROMEOS_ENDPOINT = 'embedded/setup/chromeos';
+  var SAML_REDIRECTION_PATH = 'samlredirect';
 
   /**
    * The source URL parameter for the constrained signin flow.
@@ -138,6 +139,7 @@ cr.define('cr.login', function() {
     this.gapsCookie_ = null;
     this.gapsCookieSent_ = false;
     this.newGapsCookie_ = null;
+    this.readyFired_ = false;
 
     this.useEafe_ = false;
     this.clientId_ = null;
@@ -264,6 +266,18 @@ cr.define('cr.login', function() {
   };
 
   Authenticator.prototype.constructInitialFrameUrl_ = function(data) {
+    if (data.doSamlRedirect) {
+      var url = this.idpOrigin_ + SAML_REDIRECTION_PATH;
+      url = appendParam(url, 'domain', data.enterpriseDomain);
+      url = appendParam(url, 'continue', data.gaiaUrl +
+          'o/oauth2/programmatic_auth?hl=' + data.hl +
+          '&scope=https%3A%2F%2Fwww.google.com%2Faccounts%2FOAuthLogin&' +
+          'client_id=' + encodeURIComponent(data.clientId) +
+          '&access_type=offline');
+
+      return url;
+    }
+
     var path = data.gaiaPath;
     if (!path && this.isNewGaiaFlow)
       path = EMBEDDED_SETUP_CHROMEOS_ENDPOINT;
@@ -684,6 +698,11 @@ cr.define('cr.login', function() {
 
     this.authDomain = this.samlHandler_.authDomain;
     this.authFlow = AuthFlow.SAML;
+
+    if (!this.readyFired_) {
+      this.dispatchEvent(new Event('ready'));
+      this.readyFired_ = true;
+    }

[xiyuan, 2016/03/29 02:10:49]

nit: Can we make this a method, e.g. fireReadyEvent, and call it here and  in
onContentLoad_?

[afakhry, 2016/03/29 03:12:02]

Done.

   };
 
   /**
@@ -725,6 +744,7 @@ cr.define('cr.login', function() {
       this.webview_.contentWindow.postMessage(msg, currentUrl);
 
       this.dispatchEvent(new Event('ready'));
+      this.readyFired_ = true;
       // Focus webview after dispatching event when webview is already visible.
       this.webview_.focus();
     }
@@ -766,6 +786,9 @@ cr.define('cr.login', function() {
    * @private
    */
   Authenticator.prototype.onLoadCommit_ = function(e) {
+    if (e.isTopLevel)
+      this.readyFired_ = false;

[xiyuan, 2016/03/29 02:10:49]

Good catch. Move this to clearCredentials_, which is called on every
load/reload. (If you want, you can give it a better name, e.g. resetStates or
something :))

[afakhry, 2016/03/29 03:12:02]

Done. But just to make sure, you meant to remove it from here altogether,
correct?

+
     if (this.oauthCode_)
       this.maybeCompleteAuth_();
   };