Hi, On Grist cloud the Form link can be shared to anyone freely for unrestricted data feed-in.
On our self-hosted AWS package we have SSO activated. Shared Form link seems to ask SSO credentials. Could it be that there is “no coding” existing to handle this situation so that the shared form link could bypass the SSO? Could this be a feature to be developed?
A known weakness of omnibus is its handling of links that could be public:
I think, for forms specifically, they may have a URL prefix that could be special-cased in the reverse proxy used by omnibus, to avoid routing form requests through SSO:
In general, it would be better if Omnibus were updated, or an alternative provided, that used OIDC or SAML rather than forwarded auth, so Grist could be left to judge whether auth is needed or not for a particular request.
Yeah, we could add an exception for routes with a /forms prefix. I think the only thing under it today is the GET for published forms, so it should be safe.
Agree that longer term, it’d be good to explore alternative authentication mechanisms for Omnibus.