# Landing page on saml login
**URL:** https://meta.discourse.org/t/landing-page-on-saml-login/149377
**Category:** Support
**Created:** [April 26, 2020, 8:17pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377 "2020-04-26T20:17:02Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 26, 2020, 8:17pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/1 "2020-04-26T20:17:02Z")
On previous versions, a landing page was shown on which the “login” button appeared. Clicking this buttons showed the saml login page.
Personally, I really liked this behavior. With the current version 2.4.2 this isn’t possible any more as the saml login page is shown immediately.
Is it configurable?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 27, 2020, 1:36am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/2 "2020-04-27T01:36:48Z")
I am not following, you mean we showed a modal that had a single button “Login with SAML” ?
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 27, 2020, 6:46am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/3 "2020-04-27T06:46:50Z")
No.
In a previous version (I believe it was 2.3.6), it was like this:
After clicking on “Anmelden”, the SAML login window appeared.
If I enable “local logins”, the landing page with the login button appears again, but I do not want to have local login and therefore I need to disable it.
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 29, 2020, 9:21pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/4 "2020-04-29T21:21:33Z")
Can someone help me? maybe @eviltrout ?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [April 29, 2020, 9:26pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/5 "2020-04-29T21:26:42Z")
I certainly didn’t change this on purpose. If you could help us track down when it changed that would be helpful as we could look into the context.
It’s possible it changed for security reasons.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 29, 2020, 9:36pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/6 "2020-04-29T21:36:33Z")
This was a long requested improvement to make omniauth behave like real SSO, when the number of omniauth login methods is only one.
> [@SSO vs Oauth2 difference?](https://meta.discourse.org/t/sso-vs-oauth2-difference/76543/20):
>
> This is now implemented: If there is only one external authenticator enabled and local logins are disabled and the site requires login, then users will be directed straight to the external authentication page. This exactly matches the implementation of our Discourse-native SSO. I can’t think of a reason why anyone wouldn’t want this, so this is now the default behaviour. cc @consideRatio @Joralf
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 29, 2020, 9:36pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/7 "2020-04-29T21:36:49Z")
How can I help?
one hint: if you enable “local login”, the “Landing page together with the login button” is shown.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 29, 2020, 9:38pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/8 "2020-04-29T21:38:10Z")
If you really want the confirmation page, you can link the user to `/login` (rather than the homepage). That will not trigger the login automatically.
But note this is not really supported, it is just a quirk of the implementation and may change at any time.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 29, 2020, 9:39pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/9 "2020-04-29T21:39:02Z")
New behavior is better and consistent with SSO login. If a message is needed before login it can be implemented in the Identity Provider.
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 29, 2020, 9:42pm UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/10 "2020-04-29T21:42:00Z")
ah, good to know.
I know of 2 reasons:
- show a very nice landing page with some basic information instead of that “boring” login window
- “security” (I know, its not really a big blocker). Cheap hacking scripts on the main URL (without the landing page) would fail hopefully as its required to press the login button first.
Is it possible to configure this behavior?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 30, 2020, 2:29am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/11 "2020-04-30T02:29:00Z")
> [@sbernhard](#):
>
> Is it possible to configure this behavior?
You are going to need to hire a dev here to build a plugin to change this. As it stands this is the first complaint I have heard about the new system in months.
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 30, 2020, 6:41am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/12 "2020-04-30T06:41:47Z")
I’m a dev 🙂 (see my changes in discourse\_saml)
Would you accept a PR which adds a configuration option (default: new behavior)?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 30, 2020, 8:48am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/14 "2020-04-30T08:48:39Z")
> [@sbernhard](#):
>
> “security” (I know, its not really a big blocker). Cheap hacking scripts on the main URL (without the landing page) would fail hopefully as its required to press the login button first.
The automatic redirect should not introduce any security vulnerabilities. If you are aware of an exploit, please let us know via our disclosure program: [discourse/docs/SECURITY.md at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/docs/SECURITY.md)
> [@sbernhard](#):
>
> Would you accept a PR which adds a configuration option (default: new behavior)?
I don’t think we want to add more noise to the settings until we have some more users requesting this change.
You could override this in a plugin by patching this method:
>
So I think you would want to simplify the function right down to
```ruby
def redirect_to_login
dont_cache_page
cookies[:destination_url] = destination_url
redirect_to path("/login")
end
```
---
### Author:  [@sbernhard](https://meta.discourse.org/u/sbernhard)
#### Post date: [April 30, 2020, 8:56am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/15 "2020-04-30T08:56:43Z")
Thank you. Very appreciated!
BTW: You are doing a great job with Discourse.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 30, 2020, 8:56am UTC](https://meta.discourse.org/t/landing-page-on-saml-login/149377/16 "2020-05-30T08:56:52Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.