# Bug OP-20391 -  SSO login fails in Chromium-based browsers when the identity provider redirects itself

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-20391

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 17.9.2 |
| Observed in versions | 17.9.0 |
| Sprint |  |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Oliver Günther |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Log in as an administrator. The instance has the Enterprise add-on for SSO.
    
2.  Configure a SAML or OIDC provider whose identity provider forwards the browser to another server during the login.
    
3.  Log out.
    
4.  Open the login page in Chrome or Edge and click the login button of this provider. If the provider is set as the direct login provider, open `/login` instead.
    

### What is the buggy behavior?

*   CSP errors on Chrome, as it will respect our own CSP even for the nested redirect by the IDP
    

### What is the expected behavior?

1.  An administrator can add the URLs of the other servers to the llowed login redirect URLs" in the provider form, or with anenvironment variable for seeded providers.
    
2.  OpenProject adds the origins of these URLs to `form-action`, opage of this provider. All other pages and providers keep the strict policy.
    
3.  The login through the complete redirect chain then works as expected