prepare repo bw_web_vault for OIDC

[Misterbabou]

Thanks to the community's efforts, the OIDC pull request works great.

To make the OIDC merge work, the repo bw_web_build needs some changes.

Would you like those changes to be added to the bw_web_build repository, even if the OIDC PR in the vaultwarden repository is not merged soon?
Having those changes ready in bw_web_vault might be helpful before the OIDC Vaultwarden merge.

For example, for the v2024.12.0.patch version, we can add the following lines:

• Ensure organization invitations work when a user account has not yet been created with SSO

diff --git a/apps/web/src/app/auth/set-password.component.ts b/apps/web/src/app/auth/set-password.component.ts
index ccd329dd64..8c80509af1 100644
--- a/apps/web/src/app/auth/set-password.component.ts
+++ b/apps/web/src/app/auth/set-password.component.ts
@@ -24,7 +24,7 @@ export class SetPasswordComponent extends BaseSetPasswordComponent {
     await super.onSetPasswordSuccess(masterKey, userKey, keyPair);
     // SSO JIT accepts org invites when setting their MP, meaning
     // we can clear the deep linked url for accepting it.
-    await this.routerService.getAndClearLoginRedirectUrl();
-    await this.acceptOrganizationInviteService.clearOrganizationInvitation();
+    // await this.routerService.getAndClearLoginRedirectUrl();
+    // await this.acceptOrganizationInviteService.clearOrganizationInvitation();
   }
 }

• Hide Log in with identifier (not mandatory) to help users log in without entering the SSO identifier. Would you prefer not to have those changes to have the same SSO flow as Bitwarden?

diff --git a/apps/web/src/app/auth/sso.component.html b/apps/web/src/app/auth/sso.component.html
index 59abc92e87..0a136f5a4f 100644
--- a/apps/web/src/app/auth/sso.component.html
+++ b/apps/web/src/app/auth/sso.component.html
@@ -5,18 +5,11 @@
   </div>
   <div *ngIf="!loggingIn">
     <p bitTypography="body1">{{ "ssoLogInWithOrgIdentifier" | i18n }}</p>
-    <bit-form-field>
-      <bit-label>{{ "ssoIdentifier" | i18n }}</bit-label>
-      <input bitInput type="text" formControlName="identifier" appAutofocus />
-    </bit-form-field>
     <hr />
     <div class="tw-flex tw-gap-2">
       <button type="submit" bitButton bitFormButton buttonType="primary" [block]="true">
         {{ "logIn" | i18n }}
       </button>
-      <a bitButton buttonType="secondary" routerLink="/login" [block]="true">
-        {{ "cancel" | i18n }}
-      </a>
     </div>
   </div>
 </form>
diff --git a/apps/web/src/app/auth/sso.component.ts b/apps/web/src/app/auth/sso.component.ts
index 019ab5e5ac..ebfcb9cbbd 100644
--- a/apps/web/src/app/auth/sso.component.ts
+++ b/apps/web/src/app/auth/sso.component.ts
@@ -38,7 +38,7 @@ import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legac
 // eslint-disable-next-line rxjs-angular/prefer-takeuntil
 export class SsoComponent extends BaseSsoComponent implements OnInit {
   protected formGroup = new FormGroup({
-    identifier: new FormControl(null, [Validators.required]),
+    identifier: new FormControl("Vaultwarden", [Validators.required]),
   });
   get identifierFormControl() {

• Improve SSO errors

diff --git a/libs/angular/src/auth/components/sso.component.ts b/libs/angular/src/auth/components/sso.component.ts
index ac64ae0246..2695a58679 100644
--- a/libs/angular/src/auth/components/sso.component.ts
+++ b/libs/angular/src/auth/components/sso.component.ts
@@ -389,7 +389,15 @@ export class SsoComponent implements OnInit {
         title: null,
         message: this.i18nService.t("ssoKeyConnectorError"),
       });
+    } else {
+      this.toastService.showToast({
+        variant: "error",
+        title: null,
+        message: e.message,
+      });
     }
+    this.router.routeReuseStrategy.shouldReuseRoute = () => false;
+    await this.router.navigate(["/sso"]);
   }
 
   private async navigateViaCallbackOrRoute(

• Correct SSO subpath redirection

diff --git a/apps/web/src/connectors/sso.ts b/apps/web/src/connectors/sso.ts
index e049c64e5d..5ae9d8b6ed 100644
--- a/apps/web/src/connectors/sso.ts
+++ b/apps/web/src/connectors/sso.ts
@@ -12,13 +12,13 @@ window.addEventListener("load", () => {
   } else if (state != null && state.includes(":clientId=browser")) {
     initiateBrowserSso(code, state, false);
   } else {
-    window.location.href = window.location.origin + "/#/sso?code=" + code + "&state=" + state;
+    const baseUrl = window.location.href.replace(/\/sso-connector.html.*$/, "");
     // Match any characters between "_returnUri='" and the next "'"
     const returnUri = extractFromRegex(state, "(?<=_returnUri=')(.*)(?=')");
     if (returnUri) {
-      window.location.href = window.location.origin + `/#${returnUri}`;
+      window.location.href = baseUrl + `/#${returnUri}`;
     } else {
-      window.location.href = window.location.origin + "/#/sso?code=" + code + "&state=" + state;
+      window.location.href = baseUrl + "/#/sso?code=" + code + "&state=" + state;
     }
   }
 });

[BlackDex]

To be fair, from my point of view that is up to the author of the SSO PR.
The the author mentioned it to find it difficult to add this to the current way of working on how we patch and build the web-vault.
I have created a new repo which might allow to change the way of working, so i would encourage the author to look at that then.