<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=69721933&issueIid=101) - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=69721933&issueIid=101) </details> <!--IssueSummary end--> ## Parent Part of #97 — Auth Architecture: 1:1 GitLab-to-SigNoz User Mapping **Phase:** 2 (Frontend) · Depends on Phase 1 issues (#98, #99, #100) being merged. --- ## Objective Adapt the iframe integration so that each GitLab user authenticates to SigNoz as themselves via the OIDC redirect flow, replacing the current `postMessage(O11Y_JWT_LOGIN)` shared-credential approach. ## Background ### Current flow (`frontend/src/utils/jwtAutoLogin.ts`) 1. GitLab parent window sends `O11Y_JWT_LOGIN` via `postMessage` containing `{ accessJwt, refreshJwt }` — these are tokens for a **single shared SigNoz user** 2. SigNoz iframe receives the message, validates origin/nonce/timestamp/counter 3. Calls `afterLogin(accessJwt, refreshJwt)` to set tokens in localStorage 4. Sends `O11Y_AUTH_STATUS { authenticated: true }` back to parent 5. All users share the same identity — no per-user RBAC ### Target flow (OIDC redirect in iframe) 1. SigNoz iframe loads, detects it is unauthenticated (no valid token in localStorage) 2. SigNoz redirects to GitLab OIDC authorize endpoint (`/oauth/authorize?client_id=...&scope=openid+profile+email&redirect_uri=.../api/v1/complete/gitlab&state=...`) 3. GitLab recognizes the user is already logged in (session cookie in the parent window's domain) → auto-grants without user interaction 4. GitLab redirects back to SigNoz callback (`/api/v1/complete/gitlab?code=...&state=...`) 5. SigNoz backend exchanges code for tokens, JIT-provisions user, issues **per-user** SigNoz tokens 6. SigNoz redirects to the frontend with tokens in query params (existing `CreateCallbackAuthNSession` behavior) 7. Frontend stores tokens, loads the authenticated UI ## MR Scope ### Modify: `frontend/src/utils/jwtAutoLogin.ts` **Remove or gate the `O11Y_JWT_LOGIN` handler.** When the GitLab OIDC provider is configured, the shared-credential `postMessage` flow should no longer be the auth path. Options (choose during implementation): - **Option A (feature flag):** Add an env var / config flag (e.g. `SIGNOZ_GITLAB_OIDC_ENABLED`). When true, skip `O11Y_JWT_LOGIN` handling and let SigNoz's normal unauthenticated → login redirect take over. - **Option B (detection):** If SigNoz detects it is in an iframe AND the auth domain is `gitlab_auth`, automatically redirect to the OIDC login URL instead of showing the login page. ### Modify: `frontend/src/AppRoutes/Private.tsx` (or equivalent auth guard) When the user is unauthenticated and the auth domain is `gitlab_auth`: - Instead of rendering the login page (which would show email/password fields), redirect to the OIDC login URL from the session context API (`GET /api/v2/sessions/context`) - This triggers the silent OIDC flow described above ### Handle browser restrictions **Third-party cookie / iframe redirect concerns:** - Modern browsers may block cookies in cross-origin iframes. The OIDC redirect from `signoz.example.com` (iframe) to `gitlab.example.com` (parent) and back needs cookies to work. - **Mitigation 1:** SigNoz and GitLab should be on the same top-level domain or use `SameSite=None; Secure` cookies. - **Mitigation 2:** If the redirect approach fails in certain browsers, implement a **popup-based fallback**: SigNoz opens a popup to GitLab OIDC → popup completes the flow → popup sends tokens back to the iframe via `postMessage` → popup closes. ### Retain `postMessage` for non-auth purposes The following `postMessage` flows must be **preserved unchanged**: | Message Type | Direction | Purpose | File | |-------------|-----------|---------|------| | `THEME_UPDATE` | Parent → iframe | Sync dark/light theme | `jwtAutoLogin.ts` → `useThemeSync.ts` | | `NAVIGATE_TO` | Parent → iframe | Route navigation from GitLab sidebar | `gitlabNavigation.ts` | | `O11Y_READY` | iframe → Parent | Signal iframe is loaded | `gitlabNavigation.ts` | | `O11Y_AUTH_STATUS` | iframe → Parent | Report auth state | `jwtAutoLogin.ts` | The `O11Y_AUTH_STATUS` message should continue to be sent (so GitLab knows when the iframe is authenticated), but should now report the **per-user** auth state from the OIDC flow rather than from the shared credential injection. ## Sequence Diagram ``` GitLab (parent) SigNoz (iframe) GitLab (OIDC IdP) │ │ │ │ <iframe src=signoz> │ │ │ ─────────────────────────► │ │ │ │ no valid token │ │ │ ──────────────────────────►│ │ │ redirect to /oauth/authorize │ │ │ │ │ user already logged in │ │ │ ◄──────────────────────────│ │ │ redirect to /complete/gitlab │ │ │ │ │ exchange code → per-user tokens │ │ JIT provision user │ │ │ redirect to frontend │ │ │ │ │ postMessage(O11Y_AUTH_STATUS: true) │ │ ◄───────────────────────── │ │ │ │ (authenticated as User A) │ ``` ## Acceptance Criteria - [ ] When `gitlab_auth` is configured, SigNoz iframe authenticates via OIDC redirect without requiring `O11Y_JWT_LOGIN` postMessage - [ ] OIDC redirect completes silently when user is already logged into GitLab (no user interaction) - [ ] `O11Y_AUTH_STATUS` postMessage is sent to parent after OIDC authentication completes - [ ] Theme sync (`THEME_UPDATE`) continues to work - [ ] Navigation (`NAVIGATE_TO` / `O11Y_READY`) continues to work - [ ] Popup fallback implemented or documented as a follow-up for browsers that block cross-origin iframe redirects - [ ] The login page does not flash (unauthenticated → redirect should happen before render) - [ ] Manual testing with GitLab instance + SigNoz iframe confirms per-user identity