►
Description
Sam Figeroua discusses backend implementation of this epic: https://gitlab.com/groups/gitlab-org/-/epics/11084
High-level description: Before someone approves an MR, there should be re-authentication with SAML.
Similar feature: Password required for MR approvals: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10364
A
A
B
A
C
B
B
B
C
B
B
Right
there's
the
issue
yeah.
It
was
promoted
from
issue
to
Epic
and
that's
why
it
was
confusing
that
way,
yeah
so
I'm.
Splitting
this
plan
was
to
split
this
up
into
the
back
end
in
the
front
end
parts
and
start
with
the
back
end:
first
yeah,
so
where
I'm,
initially
kind
of
stuck
on
is
figuring
out.
If
I
want
to
send
a
re-auth
request,
I'll
have
to
as
far
as
I've
understood
it
is
provided
a
a
Good
callback
or
there's
a
callback
URL.
That
saml
will
redirect
to
once.
B
They're
authenticated
right,
Jesse
feel
free
to
say,
nay,
when
I
say
something
wrong,
so,
where
I'm
having
trouble
finding
out
in
the
code
is
where
could
I
grab
on
to
parameters
that
I've
added,
like,
for
example,
I,
would
want
to
add
a
reference
to
the
Mr
that
we're
approving
and
sort
of
tag.
The
action
as
this
is
a
foreign
approval,
I
tried
getting
into
some
of
the
callbacks.
We
have
I
think
we
have
an
omni
auth
callbacks
controller,
but
I
didn't
get
very
far
with
that.
A
A
B
B
A
A
A
A
A
A
B
C
A
B
B
A
B
A
B
B
B
A
B
A
C
B
B
A
C
A
C
B
A
B
B
A
B
A
B
A
B
A
B
B
A
Be
approval
for
the
saml
off
like
I
think
the
way
this
seems
to
work
is
that
the
user
has
like
typed
in
their
password
and
then
we
pass
that
to
approval
service
and
we're
like
okay.
Is
this
the
right
password,
if
so,
allow
them
to
approve?
But
we
in
a
saml
context,
are
knocking
another
password
that
we're
just
going
to
know
whether
they
have
successfully
Sam
lost
or
not.
A
B
C
B
B
And
the
future
is
if
they
it's
like
the
first.
Let
me
let
me
check
well
this
feature
in
this
iteration.
It
doesn't
matter
as
much
but
like
the
ultimate
implementation
would
be
that
they
would
have
to
like
the
first
time
in
their
session.
They
try
to
approve
something
they
need
to
log
in
and
if
they
don't,
let's
say
they
don't
log
in
and
again
for
the
next
10
minutes
or
their
session
is
older
than
10
minutes,
then
they
would
have
to
do
it
again.
B
But
like
after
the
first
one
after
the
first
approved
like
in
the
next
10
minutes,
they
could
improve
any
without
re-authenticating
again,
so
they
sort
of
have
like
a
grace
period
like
we
know
you
just
had
a
saml
off.
So
it's
it's
fine
for
the
next
10
minutes
and
if
you
take
longer
than
that
you
step
away,
then
we'll
need
to
re-auth.
C
A
A
A
If
you'll
see
there's
like
active
session
question
mark
in
there,
and
so
it's
looking
at
session
information,
but
it
does,
you
know
so
default
session.
Timeout
is
it
is
one
day
ago
yeah,
so
you're
gonna
want
to
do
something
different,
but
I
feel
like
this
might
be
what
you're
looking
for
in
terms
of
where
to
pull
information
about
when
the
user
lasts,
say,
I'm
all
off.
B
A
B
A
A
C
C
A
C
A
Yeah
so
I
feel
like
if
you
want
to,
if
you
want
to
start
on
the
inside
out
and
just
do
the
logic,
the
very
like
lowest
level
logic.
First,
wouldn't
that
be
starting
with
this
service.
The
merge
requests,
approval
service
and,
in
there
saying,
if
this
setting
is
set,
make
sure
that
active
sense
cut
off
of
arbitrary
timestamp
15
minutes
ago.
Whatever
is
true
and
then
allow
it,
and
that's
kind
of
this,
like
the
most
low
level
piece.
B
A
B
B
A
A
B
B
A
B
B
B
It's
like
sort
of
the
I
was
probably
because
I
was
looking
at
the
the
bigger
picture,
together
with
the
the
FDA
compliance
request,
where
the
people
also
had
to
like
sign
their
name
or
something
that
was
like
the
initial
request
they
had
to
like
type
in
their
name
and
then
authenticate,
and
they
had
to
have
their
name
in
there
with
it.
Whoa.
A
B
B
A
B
A
A
B
A
A
B
Roller
and
usually
I'll
try
to
I'll
try
to
use
it
to
like
have
a
a
list
of
things.
I
need
every
day
when
I
have
too
many
tabs
open
I'll
try
to
figure
out
like
I'll.
Have,
let's
see
all
right
like
this,
I'll
have
just
a
link
to
like
a
day
daily
list
and
then,
like
things,
I've
used
that
day.
Those
will
go
like
on
this
link
list.
B
B
A
B
A
C
B
Yeah
I,
don't
like
Google
docs
for
I've
used,
tried
using
it
for
notes
and
everything
but
I,
just
even
the
king
of
search
Google,
and
you
think
it's
only
doesn't
work
very
well
in
other
apps.
They
try
to
find
something
on
Google,
Docs
or
on
drive.
It
seems
to
fall
apart
more
than
yeah.
Then
it
should
yeah.