What happens
A federated login authenticates the REST API and Volto, and does not produce a session for Classic UI.
core/services/callback/post.py mints a jwt_auth token, and every request afterwards rides that token. There is no __ac cookie anywhere in the codebase, and Classic UI authenticates through credentials_cookie_auth.
Why it matters
pas.plugins.oidc has a create_ticket setting for exactly this — it mints the Plone __ac cookie so a federated login works in Classic Plone. This package has no equivalent.
Nothing in docs/ states a Volto-only scope, so the limitation is currently invisible to anybody reading the documentation.
Its counterpart needs nothing: minting the JWT is unconditional here, so create_restapi_ticket is permanently on by another name.
Decide first, build second
This is a scope question rather than a feature request. Two ways out:
- Implement the
__ac ticket, so a federated login works in Classic UI.
- State the Volto-only scope in the documentation.
It should not stay undocumented either way.
Found in a parity audit against pas.plugins.oidc.
What happens
A federated login authenticates the REST API and Volto, and does not produce a session for Classic UI.
core/services/callback/post.pymints ajwt_authtoken, and every request afterwards rides that token. There is no__accookie anywhere in the codebase, and Classic UI authenticates throughcredentials_cookie_auth.Why it matters
pas.plugins.oidchas acreate_ticketsetting for exactly this — it mints the Plone__accookie so a federated login works in Classic Plone. This package has no equivalent.Nothing in
docs/states a Volto-only scope, so the limitation is currently invisible to anybody reading the documentation.Its counterpart needs nothing: minting the JWT is unconditional here, so
create_restapi_ticketis permanently on by another name.Decide first, build second
This is a scope question rather than a feature request. Two ways out:
__acticket, so a federated login works in Classic UI.It should not stay undocumented either way.
Found in a parity audit against
pas.plugins.oidc.