OpenID login in TYPO3 >=8.7.31 broken

[sirdiego]

This core commit TYPO3/typo3@0d5ae4e introduced the usage of symfony/http-foundation for some cookie handling. This broke the openid extension. 8.7.30 works fine, 8.7.31 and 8.7.32 are broken. My guess would be it has something to do with a $_COOKIE check somewhere, but I did not have the time, jet, to inspect the problem more.

[liayn]

I guess this not really broken in the extension, but you need to configure the new setting of TYPO3 differently. The browsers (foremost Chrome) are enforcing this now. (Albeit they relaxed it again as of yesterday due to COVID-19)

[sirdiego]

Hey @liayn, thanks for the feedback. I installed a fresh TYPO3 and only added the openid extension. Only default settings. Do I have to do something to make it work with TYPO3 and extension default configuration? If it is not a technical problem maybe we should "solve" this through documentation?

[liayn]

Do you use openid for BE or FE authentication?

[sirdiego]

I'm sorry, I should have clarified. It's backend only for us.

[liayn]

Check if it helps to modify TYPO3_CONF_VARS|BE|cookieSameSite = none

[sirdiego]

Still does not work. I created a completely fresh instance with:

composer create-project "typo3/cms-base-distribution:^8.7" my-new-project
cd my-new-project
composer require friendsoftypo3/openid
touch public/FIRST_INSTALL

I then clicked through the install wizard and added my OpenID URL to the newly created admin user. When I try to log in to the backend via OpenID it redirects me back to this URL: http://my-lando-app.lndo.site/typo3/index.php?commandLI=setCookie. And shows the error message:

Your login attempt did not succeed
Make sure to spell your username and password correctly, including upper/lowercase characters.

Changing TYPO3_CONF_VARS|BE|cookieSameSite does not change that behavior.

Does this clarify the problem?

[liayn]

I tried my best to analyze the issue, but I fail to do that properly as I do not have an openid provider anymore myself. All usual ones (M$, Google, Mozilla etc) have been shut down. Generally OpenID 2.0 as used here has been superseded by OpenID Connect.

[liayn]

I updated the extension now to include the latest release of the upstream php-openid libaray. Maybe this helps here.

[dmitryd]

In your web/typo3conf/LocalConfiguration.php:

return [
  'BE' => [
    'cookieSameSite' => 'lax',
    ...
 ],
];

This will be documented.

[sirdiego]

I'm a little late here, but thanks for the hint. Setting cookieSameSite to lax does indeed work. Thanks!