nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Do the Login & Logout events exist and are they exploitable with ScriptRunner?

ADyPo

Environment : Cloud (Confluence, JSD, JSW)

Hello everyone,

The events I'm finding in the documentations are related to the Atlassian tooling (issues, pages, etc.).

I can't seem to find the answer so here is the question : can I use ScriptRunner to trigger an action on login / on logout ?

About the use-cases:

- For the login, I'm trying to exploit some custom SAML attributes that I'm receiving from an identity provider on login (I'm using SAML SSO).

- For the logout, I want to call an API to notify the identity provider that the user logged-out (there's no logout binding).

Thank you all in advance,

Regards,

Dylan

Accepted answers

PD Sheehan

I've been able to trigger some actions on login event.

But I am not sure how you would tie in your login event script with the SAML attributes unless you can make some api call back to your saml idp and retrieve those attributes again.

However, with SAML SSO (reichert solution) I am not detecting any logout event.

If you can't do logout binding, perhaps you can trick your system by hiding the default logout link, and substitute your own that would go to a scriptrunner rest api and after your script runs, you redirect the user to the default logout page.

All comments

PD Sheehan

I've been able to trigger some actions on login event.

But I am not sure how you would tie in your login event script with the SAML attributes unless you can make some api call back to your saml idp and retrieve those attributes again.

However, with SAML SSO (reichert solution) I am not detecting any logout event.

PD Sheehan

Looks like I am able to detect the logout even if I disable the Logout Redirection from my SAML plugin.

ADyPo

Hi @PD Sheehan and thanks!

Your answers are quite encouraging for the current investigation and I thank you very much for the side-tips about the use-cases.

I'd like to know where you went to detect the events / how you did it. Can you redirect me to some documentation please ? I can't seem to go further than manipulating existing events in the "Script Listeners" tab / testing code in the "Script Console" tab.

Thanks a lot again,

Regards,

Dylan

PD Sheehan

Well, the Script Listener tab is where you want to be.

Create a new custom script listener,
select LoginEvent or LogoutEvent in the Events to listen too,
Write a script for what you want to do when that event is detected

In my case all I did was write a line of text to the log:

2020-10-20 10_30_15-Window.png

Then I tailed the log while logging out with a test account and saw that line go in the log.

Both the LoginEvent and the LogoutEvent generate an UserEvent (as subclasses).

You can see the documentation for those event classes here: https://docs.atlassian.com/software/jira/docs/api/8.11.1/com/atlassian/jira/event/user/UserEvent.html

You will see that there isn't a whole lot of information in those classes, but at least the user is there, that's probably the most critical piece.

The rest of the script will really be depending on what you intend to do.

The only other documentation I can point you to is the generic custom listener page at adaptivist: https://scriptrunner.adaptavist.com/6.5.0-p5/jira/listeners.html#_custom_listeners

Krzysztof_7cdi8h

@PD Sheehan Were you able to get the username? to me returns null

PD Sheehan

Hi @Krzysztof

Not sure if you got from the thread that all my advice were only applicable to server/dc.

If you're on cloud, I can't help.

But for server, I have no issue accessing the user with:

def user = (event as LoginEvent).user //returns ApplicationUser

Krzysztof_7cdi8h

Thanks! @PD Sheehan

import com.atlassian.jira.event.user.UserEvent

import com.onresolve.scriptrunner.runner.util.UserMessageUtil

def newUserEvent = event as UserEvent;

def appUser = newUserEvent.getUser();

int userEventType = newUserEvent.getEventType();

def message = "change your pass"

UserMessageUtil.info(message)

listner: LoginEvent, LoginFailedEvent and LogoutEvent

the above script shows the message only for the event: LogoutEvent

there is no error in the log - but the message does not appear both when logging in and when logging in incorrectly does anything else need to be added here?

PD Sheehan

You can go review the javadocs for each of those events: LoginEvent, LogoutEvent, LoginFailedEvent

Or output some details to the log to see what's available in each class and build out a script that can show you those details.

E.g.

import com.atlassian.jira.event.user.LoginFailedEvent
import com.atlassian.jira.event.user.LoginEvent
import com.atlassian.jira.event.user.LogoutEvent

log.info event.metaClass*.methods.name.sort().unique()
log.info "event =$event"
log.info "event class=${event.getClass()}"
log.info "event.initiatingUser=$event.initiatingUser"
log.info "event.user=$event.user"
if(event instanceof LoginFailedEvent){
    log.info "event.loginInfo=$event.loginInfo"
    log.info "event.loginReason=$event.loginReason"
}

Whether the UserMessageUtil works in all cases or not, could be a matter of how that class is implemented. I think it's primarily designed for workflow feedback as it relies on certain client-side scripts being loaded and ready.

I'm also unable to make it work on Login or LoginFailed events.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

adaptavist

api

authentication

saml

event

trigger

logout