Iterative improvements for SAML session refresh modal

In Inconsistent behavior for "resumed" SAML sessions (#419578 - closed) we added a modal that prompts users to refresh their page or login again if they are in the middle of typing a draft comment on an issue, and the SAML session expires. This was rolled out to GitLab team members and later production via #456996 (closed).

Some of the improvement that can be made are:

• Closing the modal in one tab should close it on other tabs if the session is shared across them. Currently the user must do that in each tab.
• A banner is displayed for refreshing the SAML session for to-dos while a modal is used for the comments. While this was done to ensure the interrupt is added for immediate action, it deviates from UI component used and we should get UX input on consolidating it. This can be done separate of this issue.

added groupauthentication typemaintenance labels

added devopsgovern sectionsec labels

fyi @eduardosanz

I'm constantly getting the following message:

"Your SAML session has expired. Please, reload the page and sign in again, if necessary."

This happens even when I'm active, typing a comment, etc. It's driving me crazy, what to do next? Logging off and in again doesn't help. Clearing my cache doesn't help. I'm running Chrome on Linux.

https://www.reddit.com/r/gitlab/comments/1j5j3fq/getting_spammed_by_your_saml_session_has_expired/

@eduardosanz this might be unrelated, but any idea with this Reddit user might be getting an excessive amount of SAML refresh messages?

@aregnery, we have implemented a very simple modal to prevent users to lose comments or notes. The customer could save the comment and reload the page which should trigger a re-authentication.

I the future we will be adding another modal that will show before the session is expired with a mechanism to extend the session.

Gotcha @eduardosanz. I'm guessing if the SAML settings are configured with short-lived sessions then that could be what is triggering the frequent expiration. Not sure if they are on self-managed or not, but the recourse would be to let an instance Administrator know.

As far as I understand, (1) every 24 hours the SAML session expires, (2) the user is redirected to the identity provider (IdP), (3) then a couple of things could happen depending of the setup of the IdP, (3a) the user has still an active session with the IdP then it is redirected back to GitLab or (3b) the user has to authenticate with the IdP at which point is then redirected back to GitLab.

(3a) could be very fast.

(3b) could be tedious.

@dblessing is the expert on this. I let him correct me.

@aregnery @eduardosanz The SAML session expiration is not configurable. It's 24 hours for all GitLab.com SAML users. You should only see this once per day although you could see it across multiple tabs which can be annoying.

@eduardosanz as an aside, can we verify the 'Reload' button works? I seem to recall I hit the modal yesterday and the 'Reload' button didn't do anything. But it might have been something weird in my specific case.

Sure, I can double check, but it is a plain vanilla JS window.open(currentUrl).