bug：enable openid-connect plugin without redirect_uri got 500 error #2426

liuxiran · 2020-10-10T09:12:06Z

Please answer these questions before submitting your issue.

Bug

Which version of Apache APISIX Dashboard, OS, and Browser?

create a route, enable openid-connect plugin, configs:

{
	"name": "api2",
	"route_group_id": "de45ec14-317f-4177-8a22-10ab95bd45f7",
	"route_group_name": "group1",
	"status": true,
	"desc": "",
	"protocols": ["http"],
	"paths": ["/get1"],
	"methods": ["GET"],
	"upstream_protocol": "https",
	"type": "roundrobin",
	"plugins": {
		"openid-connect": {
			"client_id": "kbyuFDidLLm280LIwVFiazOqjO3ty8KH",
			"client_secret": "60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa",
			"discovery": "https://samples.auth0.com/.well-known/openid-configuration"
		}
	},
	"script": {},
	"uris": ["/get1"],
	"vars": [],
	"upstream": {
		"type": "roundrobin",
		"nodes": {
			"httpbin.org:443": 1
		},
		"timeout": {
			"connect": 6000,
			"send": 6000,
			"read": 6000
		}
	},
	"upstream_header": {},
	"upstream_path": {
		"to": "/get"
	}
}

visit this route via chrome, got 500 error

got the error log in apisix error.log:

2020/10/10 06:47:45 [error] 26#26: *6045490 [lua] openidc.lua:1378: authenticate(): request to the redirect_uri path but there's no session state found, client: 192.168.1.145, server: , request: "GET /get HTTP/1.1", host: "192.168.1.145:9
2020/10/10 06:47:45 [error] 26#26: *6045490 [lua] openid-connect.lua:163: phase_func(): failed to authenticate in openidc: request to the redirect_uri path but there's no session state found, client: 192.168.1.145, server: , request: "GET
2020/10/10 06:47:45 [error] 25#25: *6045493 lua entry thread aborted: runtime error: /usr/local/apisix/apisix/plugins/echo.lua:96: attempt to index local 'conf' (a userdata value)
stack traceback:                                                                                                                                            
coroutine 0:                                                                                                                                             
        /usr/local/apisix/apisix/plugins/echo.lua: in function 'phase_fun'                                                                                     
        [string "route#41ee9eef-564e-4208-86e6-fc6834bd7178"]:17: in function 'phase_func'                                                                  
        /usr/local/apisix/apisix/script.lua:52: in function 'run'                                                                                                 
        /usr/local/apisix/apisix/init.lua:508: in function 'http_access_phase'                                                                                 
        access_by_lua(nginx.conf:173):2: in main chunk, client: 192.168.1.145, server: , request: "GET /favicon.ico HTTP/1.1", host: "192.168.1.145:9080", referrer: "http://192.168.1.145:9080/get"

redirect_uri should be a reqired param in openid-connect plugin

The text was updated successfully, but these errors were encountered:

juzhiyuan · 2020-10-10T14:17:37Z

Here is the doc for openid-connect, cc @membphis

https://github.com/apache/apisix/blob/master/doc/plugins/openid-connect.md

membphis · 2020-10-11T01:36:20Z

@nic-chen need your help to confirm a mini case

juzhiyuan · 2020-10-15T02:29:00Z

This issue is related to apisix according to @nic-chen's feedback, so I transfer it here.

nic-chen · 2020-10-16T15:18:33Z

@membphis

I think it's a schema defined bug.
redirect_uri should be required according to the error log.

@liuxiran Could you solve it together, please? It looks like you are solving issues of other plugins's schema 😄

https://github.com/apache/apisix/blob/master/apisix/plugins/openid-connect.lua#L45

membphis · 2020-10-17T14:18:46Z

I think it's a schema defined bug.
redirect_uri should be required according to the error log.

A new PR to fix this bug is better. welcome PR

fukiki · 2020-10-19T11:01:52Z

@nic-chen
If redirect_uri is not provided in schema, it will be set by ngx.var.request_uri, please see openid-connect.lua, Dose this mean that request_uri already has a default value, request_uri should be optional?
Looking forward to your reply, thx

moonming · 2020-10-21T09:06:44Z

@nic-chen @membphis ping

membphis · 2020-10-21T09:23:17Z

@moonming Please confirm which way is correct. You wrote this code.

if the redirect_uri is a required field.
if not, what is the default value? ctx.var.request_uri?

https://github.com/apache/apisix/blob/master/apisix/plugins/openid-connect.lua#L143-L146

moonming · 2020-10-21T10:07:30Z

yes, redirect_uri is optional

membphis · 2020-10-22T04:53:49Z

2020/10/10 06:47:45 [error] 26#26: *6045490 [lua] openid-connect.lua:163: phase_func(): failed to authenticate in openidc: request to the redirect_uri path but there's no session state found, client: 192.168.1.145, server: , request: "GET

we got this error, I think it is fine. because you did not set a correct redirect_uri.

when missing redirect_uri, it'll use ctx.var.request_uri as default value: http://nginx.org/en/docs/http/ngx_http_core_module.html#var_request_uri .

2020/10/10 06:47:45 [error] 25#25: *6045493 lua entry thread aborted: runtime error: /usr/local/apisix/apisix/plugins/echo.lua:96: attempt to index local 'conf' (a userdata value)
stack traceback:                                                                                                                                            
coroutine 0:                                                                                                                                             
        /usr/local/apisix/apisix/plugins/echo.lua: in function 'phase_fun'                                                                                     
        [string "route#41ee9eef-564e-4208-86e6-fc6834bd7178"]:17: in function 'phase_func'                                                                  
        /usr/local/apisix/apisix/script.lua:52: in function 'run'                                                                                                 
        /usr/local/apisix/apisix/init.lua:508: in function 'http_access_phase'

@liuxiran that is another error message of plugin echo, but I do not find you enabled this plugin. so I think this error message is not related to this issue.

liuxiran · 2020-10-22T07:06:26Z

2020/10/10 06:47:45 [error] 26#26: *6045490 [lua] openid-connect.lua:163: phase_func(): failed to authenticate in openidc: request to the redirect_uri path but there's no session state found, client: 192.168.1.145, server: , request: "GET

we got this error, I think it is fine. because you did not set a correct redirect_uri.

when missing redirect_uri, it'll use ctx.var.request_uri as default value: http://nginx.org/en/docs/http/ngx_http_core_module.html#var_request_uri .

2020/10/10 06:47:45 [error] 25#25: *6045493 lua entry thread aborted: runtime error: /usr/local/apisix/apisix/plugins/echo.lua:96: attempt to index local 'conf' (a userdata value)
stack traceback:                                                                                                                                            
coroutine 0:                                                                                                                                             
        /usr/local/apisix/apisix/plugins/echo.lua: in function 'phase_fun'                                                                                     
        [string "route#41ee9eef-564e-4208-86e6-fc6834bd7178"]:17: in function 'phase_func'                                                                  
        /usr/local/apisix/apisix/script.lua:52: in function 'run'                                                                                                 
        /usr/local/apisix/apisix/init.lua:508: in function 'http_access_phase'

@liuxiran that is another error message of plugin echo, but I do not find you enabled this plugin. so I think this error message is not related to this issue.

@membphis Thank you very much~! since It has nothing wrong about the openid-connect schema, I'll try again to config a right redirect_uri :)

then close this issue, thx again~!

tangjun2012 · 2021-01-05T10:57:50Z

I had the same problem.
https://github.com/zmartzone/lua-resty-openidc/blob/v1.7.2/lib/resty/openidc.lua Line 1361
local session, session_error = r_session.start(session_opts)
https://github.com/bungle/lua-resty-session/blob/v2.24/lib/resty/session.lua Line 320
return self, present
session_error receives the value of present，session is not initialized present

lemonrains · 2021-11-25T03:08:51Z

I had the same problem. https://github.com/zmartzone/lua-resty-openidc/blob/v1.7.2/lib/resty/openidc.lua Line 1361 local session, session_error = r_session.start(session_opts) https://github.com/bungle/lua-resty-session/blob/v2.24/lib/resty/session.lua Line 320 return self, present session_error receives the value of present，session is not initialized present

I got the same error, how did you solve it finally?

lemonrains · 2021-11-25T03:54:49Z

Refer the following link, I solved my problem.

https://stackoverflow.com/questions/49338403/openidc-with-keycloak-error-uthenticate-request-to-the-redirect-uri-path-but

Your redirect URI must not be set to "/" but to some arbitrary path that is not supposed to return content (like /redirect_uri). It is a "vanity" URL that is handled by lua-resty-openidc

membphis · 2021-11-27T08:14:57Z

@lemonrains do we need to update the code or docs of APISIX?

david-woelfle · 2022-04-06T19:25:56Z

Came across the same problem today and did some testing on the problem with an up-to-date apisix instance. It seems like this problem (request to the redirect_uri path but there's no session state found) only happens if the user requested URI and the redirect_uri are identical.

The reason could be that the openid-connect plugin probably checks if the user requested URI is identical to redirect_uri and if that is the case assumes that user has already been redirected back from the Auth server and should already have a valid session cookie. The plugin hence expects a session cookie and then fails with the error above if it finds no session state. @membphis or @moonming could you maybe confirm that this is what the plugin does?

If my hypothesis is correct then I would assume this is a bug and I find that the approach of @lemonrains is not a good solutions. Here is why:

Assume you try to protect an upstream API with OpenID, say https://httpbin.org/image/png
The exposed route for the upstream could be https://example.com/image/png
If users without a session yet try to access https://example.com/image/png they should be redirected to the Auth server to redeem a session. (This redirect currently fails).
After the authentication passed the users should be redirected back to the original target URI (https://example.com/image/png) because that is the resource they initially tried to access. (Please note that this what the openid-connect plugin actually tries to do by default as redirect_uri has a default value of "ngx.var.request_uri", which is IMHO the right thing to do and absolutely correct. The docs are correct too, just the implementation in the plugin seems to have a bug ;) )

moonming · 2022-04-06T23:54:39Z

@david-woelfle thanks for your detailed report 👍
@starsz @membphis please take a look, thx

membphis · 2022-04-07T01:07:33Z

@starsz I have reopened this issue right now.

Do you have time to check this bug?

starsz · 2022-04-07T01:26:17Z

@starsz I have reopened this issue right now.

Do you have time to check this bug?

Sure. Let me have a check.

starsz · 2022-04-07T02:46:22Z

The reason could be that the openid-connect plugin probably checks if the user requested URI is identical to redirect_uri and if that is the case assumes that user has already been redirected back from the Auth server and should already have a valid session cookie. The plugin hence expects a session cookie and then fails with the error above if it finds no session state. @membphis or @moonming could you maybe confirm that this is what the plugin does?

Hi @david-woelfle .Yes, that's true.
Now, Apache APISIX uses "lua-resty-openidc" to deal with the openid-connect loginc.
You can refer to the code here :

https://github.com/zmartzone/lua-resty-openidc/blob/a468d13283d62ef5e3d14f02404294f7777c053d/lib/resty/openidc.lua#L1472-L1481

Assume you try to protect an upstream API with OpenID, say https://httpbin.org/image/png
The exposed route for the upstream could be https://example.com/image/png
If users without a session yet try to access https://example.com/image/png they should be redirected to the Auth server to redeem a session. (This redirect currently fails).
After the authentication passed the users should be redirected back to the original target URI (https://example.com/image/png) because that is the resource they initially tried to access. (Please note that this what the openid-connect plugin actually tries to do by default as redirect_uri has a default value of "ngx.var.request_uri", which is IMHO the right thing to do and absolutely correct. The docs are correct too, just the implementation in the plugin seems to have a bug ;) )

Here, I think you may misunderstand the usage of redirect_uri.
In fact:

Assume you try to protect an upstream API with OpenID, say https://httpbin.org/image/png
The exposed route for the upstream could be https://example.com/image/png
If users without a session yet try to access https://example.com/image/png they should be redirected to the Auth server to redeem a session and Apache APISIX will store the target_url (default is request URI) in session. You can refer : https://github.com/zmartzone/lua-resty-openidc/blob/a468d13283d62ef5e3d14f02404294f7777c053d/lib/resty/openidc.lua#L366-L371
After the authentication passed, the Auth server will redirect to the redirect_uri (which is config in Apache APISIX), and Apache APISIX will get the code and state from the redirection. You can refer: https://github.com/zmartzone/lua-resty-openidc/blob/a468d13283d62ef5e3d14f02404294f7777c053d/lib/resty/openidc.lua#L1092-L1204
And Apache APISIX will use the code and state to get the access_token, and use access_token to get the user info.
After this, Apache APISIX then will redirect to the target URI (which is stored in the session, is https://example.com/image/png).You can refer: https://github.com/zmartzone/lua-resty-openidc/blob/master/lib/resty/openidc.lua#L1205

So the flow should be like this:

In a conclusion, it's a bug.But I think it's a little bit hard to fix it.

Refer the following link, I solved my problem.
https://stackoverflow.com/questions/49338403/openidc-with-keycloak-error-uthenticate-request-to-the-redirect-uri-path-but
Your redirect URI must not be set to "/" but to some arbitrary path that is not supposed to return content (like /redirect_uri). It is a "vanity" URL that is handled by lua-resty-openidc

It's a quick way to fix it.

spacewander · 2022-08-08T05:54:32Z

@liweitianux
I see. Would you like to submit a PR for that? Thanks!

liweitianux · 2022-08-08T06:58:56Z

@liweitianux I see. Would you like to submit a PR for that? Thanks!

Yes, I could make a PR, but maybe a bit late due to various works at hand.

By the way, I'm still a newbie to APISIX, so how should I obtain the current route's uri config in the plugin? It's needed to derive the redirect_uri.

In addition, I still need to consider how to handle the redirect_uri for the Service/Consumer/Global cases.

jaysonsantos · 2022-08-12T10:59:49Z

For those still struggling with that, by default resty.session will try to use aes as the encryption algorithm for the cookie that holds the session, but without setting session_secret session.start will fail with the reason EVP_DecryptFinal_ex, to avoid that you have to set it with a 32 bytes random value.
If using the helm chart to spin up apisix, this should do the trick

configurationSnippet:
  httpSrv: |
    set $session_secret 8044c47e83b5ac9bb7c868eb8b202e93;

to generate that secret:

openssl rand 16 -hex

spacewander · 2022-08-14T12:57:03Z

@liweitianux I see. Would you like to submit a PR for that? Thanks!

Yes, I could make a PR, but maybe a bit late due to various works at hand.

By the way, I'm still a newbie to APISIX, so how should I obtain the current route's uri config in the plugin? It's needed to derive the redirect_uri.

In addition, I still need to consider how to handle the redirect_uri for the Service/Consumer/Global cases.

@liweitianux
Sorry for missing this!
You can use ctx.curr_req_matched._path to get the matched part of the uri.

Previously the `redirect_uri` was set to `ngx.var.request_uri` if not configured. However, it caused the underlying `lua-resty-openidc` module to raise this error: ``` request to the redirect_uri path but there's no session state found ``` because `lua-resty-openidc` would think it was the redirection response from OP when the `redirect_uri` equals `ngx.var.request_uri`. Although the OAuth 2.0 Security Best Current Practice [1] recommends that the `redirect_uri` should be explicitly specified to prevent malicious redirection attacks, it would also be handy for APISIX to properly determine a default one if `redirect_uri` not given. Therefore, append the `.apisix/redirect` suffix to the current request URI to determine the default `redirect_uri`. It makes `lua-resty-openidc` happy and it's almost unlikely to conflict with user's URIs. Also note that the OP should be properly configured to accept such auto-determined redirect URIs. Update the documentation accordingly. Fix apache#2426. [1] https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/

kingluo · 2022-10-01T07:44:41Z

For those still struggling with that, by default resty.session will try to use aes as the encryption algorithm for the cookie that holds the session, but without setting session_secret session.start will fail with the reason EVP_DecryptFinal_ex, to avoid that you have to set it with a 32 bytes random value. If using the helm chart to spin up apisix, this should do the trick
configurationSnippet:
  httpSrv: |
    set $session_secret 8044c47e83b5ac9bb7c868eb8b202e93;

The nginx variable would make all openidc instances use the same secret.
So the best way is to distinguish the host and set it accordingly.

     set_by_lua_block $session_secret {
         local secrets = {
            ["foo.domain"] = "xxx",
            ["bar.domain"] = "yyy",
         }
         return secrets[ngx.var.host] or "zzz"
     }

canob · 2023-05-27T04:46:50Z

Hi @starsz I change the redirect_uri callback to "pathtoprotect"/callback and some times it just redirect to the Auth Server and others keep throwing 500 error (state not found), i cant figure out why, some toughts?

Hi @Xarxavier,

Did you find a solution for this?
I'm experiencing a similar behavior of the one that you comment: when I'm not authenticated, I get the authentication page, do a succeded authentication, but after that, I get a 500 error, on the redirect.

The URL is this one:
http://keycloakurl/realms/myreal/protocol/openid-connect/auth?state=e00f033714f2087c5b902610990cf342&redirect_uri=http%3A%2F%2Fapisixurl%3A9080%2Fadd_note%2Fcallback&client_id=grafana-oauth&scope=openid%20email%20profile%20offline_access%20roles&nonce=119423136878333950d28060c3c51b05&response_type=code

The strange thing is that if I remove the "callback" word of that URL, from the redirect_uri part, I get the response of the upstream API, authenticated:
http://keycloakurl/realms/myreal/protocol/openid-connect/auth?state=e00f033714f2087c5b902610990cf342&redirect_uri=http%3A%2F%2Fapisixurl%3A9080%2Fadd_note&client_id=grafana-oauth&scope=openid%20email%20profile%20offline_access%20roles&nonce=119423136878333950d28060c3c51b05&response_type=code

In my case, I'm trying to access to "http://apisixurl:9080/add_note", and as I saw in the documentation, I added a redirect_uri param with the value "http://apisixurl:9080/add_note/callback". My route is "/add_note*".

This was working right, but using Chromium with --disable-web-security to disable CORS of Web Browser for Keycloak, and I put a Nginx Reverse Proxy in Front of Keycloak to add Access-Control-Allow-Origin * header to the Keycloak response. After that, I always get a 500 error from APISIX after the redirect from Keycloack.

As somebody mentioned before, I cannot set the same access url and redirect url, because that is not working for this plugin.

Is there any piece of advice that you can give me?

Thanks in advance.

Xarxavier · 2023-05-29T14:55:34Z

Hi @starsz I change the redirect_uri callback to "pathtoprotect"/callback and some times it just redirect to the Auth Server and others keep throwing 500 error (state not found), i cant figure out why, some toughts?

Hi @Xarxavier,

Did you find a solution for this? I'm experiencing a similar behavior of the one that you comment: when I'm not authenticated, I get the authentication page, do a succeded authentication, but after that, I get a 500 error, on the redirect.

The URL is this one: http://keycloakurl/realms/myreal/protocol/openid-connect/auth?state=e00f033714f2087c5b902610990cf342&redirect_uri=http%3A%2F%2Fapisixurl%3A9080%2Fadd_note%2Fcallback&client_id=grafana-oauth&scope=openid%20email%20profile%20offline_access%20roles&nonce=119423136878333950d28060c3c51b05&response_type=code

The strange thing is that if I remove the "callback" word of that URL, from the redirect_uri part, I get the response of the upstream API, authenticated: http://keycloakurl/realms/myreal/protocol/openid-connect/auth?state=e00f033714f2087c5b902610990cf342&redirect_uri=http%3A%2F%2Fapisixurl%3A9080%2Fadd_note&client_id=grafana-oauth&scope=openid%20email%20profile%20offline_access%20roles&nonce=119423136878333950d28060c3c51b05&response_type=code

In my case, I'm trying to access to "http://apisixurl:9080/add_note", and as I saw in the documentation, I added a redirect_uri param with the value "http://apisixurl:9080/add_note/callback". My route is "/add_note*".

This was working right, but using Chromium with --disable-web-security to disable CORS of Web Browser for Keycloak, and I put a Nginx Reverse Proxy in Front of Keycloak to add Access-Control-Allow-Origin * header to the Keycloak response. After that, I always get a 500 error from APISIX after the redirect from Keycloack.

As somebody mentioned before, I cannot set the same access url and redirect url, because that is not working for this plugin.

Is there any piece of advice that you can give me?

Thanks in advance.

Hello @canob the error 500 in my case was because something wasnt able to reach apisix... like the state look if the reverse proxy is passing all the parameters correctly and check if you have connectivity between those two(apisix and keycloack) in any case with the log maybe i can provide further help.
Since those two were working fine before probably is because your reverse proxy is messing something.
Without further knowledge i cant say for sure
Greetings

canob · 2023-05-29T14:58:25Z

Hello @canob the error 500 in my case was because something wasnt able to reach apisix... like the state look if the reverse proxy is passing all the parameters correctly and check if you have connectivity between those two(apisix and keycloack) in any case with the log maybe i can provide further help. Since those two were working fine before probably is because your reverse proxy is messing something. Without further knowledge i cant say for sure Greetings

Thanks @Xarxavier , I'm going to review the headers that my reverse proxy is passing.
Regards!

juzhiyuan · 2023-09-06T02:05:37Z

Hello,

For your records, if you're using NGINX with APISIX and encounter the same issue, please check as follows:

Check your NGINX error.log: if you can find the same error, go ahead:

Set configuration block like this

Try again!

Radu-Iuonac · 2023-09-19T15:40:43Z

Hi,
I am facing a similar issue with APISIX. I deployed APISIX in GCP GKE and tried integrating it with Auth0. In my case my API GW is accessed from a FE app which already performs login with Auth0 and thus has a valid token.
I configured my APISIX route like this

{
  "uri": "/my-service/*",
  "name": "My Route",
  "plugins": {
    "openid-connect": {
      "bearer_only": true,
      "client_id": "AUTH0_CLIENTID",
      "client_secret": "AUTH0_SECRET",
      "discovery": AUTH0_DOMAIN.well-known/openid-configuration",
      "redirect_uri": "http://localhost:8082/my-service/redirect",  // same as Auth0 callback as mentioned in previous threads
      "scope": "openid profile"
    }
  },
  "upstream_id": "1",
  "status": 1
}

When calling the api with a -H "Authorization: Bearer AUTH0_TOKEN" i get a 401 Authorization Required error, why is this?
If I set the bearer_only to false and still call the API with -H "Authorization: Bearer AUTH0_TOKEN" it redirects me to login. It looks like API SIX ignores the fact that I have a valid token.
If I call the endpoint from browser then I get redirected to Auth0, I login, get a session and redirect to my api all good.

I see myself forced to use API SIX as a simple API GW without any security and handle the security in each upstream service individually. It is quite sad as this project has a lot of potential.

If anybody has encountered this issue before and has a solution please do share!

moonming · 2023-09-20T01:49:18Z

@monkeyDluffy6017 please take a look

kayx23 · 2023-09-20T02:52:31Z

@Radu-Iuonac if your issue is not related to the no session state found error that leads to 500 (it seems to be the case from your description), could you see if your issue could be resolved with this new doc (that was recently verified to be working as intended)? https://docs.api7.ai/apisix/how-to-guide/authentication/set-up-sso-with-auth0#authenticate-with-client-credentials

Let use know if any feedback.

Radu-Iuonac · 2023-09-20T06:56:00Z

Hi @kayx23,

No unfortunately it is not working. When I make a request to a route that has

"openid-connect": {
      "bearer_only": true,
      "client_id": "AUTH0_CLIENTID",
      "client_secret": "AUTH0_SECRET",
      "discovery": "AUTH0_DOMAIN/.well-known/openid-configuration",
      "redirect_uri": "http://localhost:8082/my-service/redirect",
      "scope": "openid profile"
    }

even if I send a valid token in the Authorization header I get a 401 Unauthorized

Radu-Iuonac · 2023-09-20T07:18:56Z

I see the error with Introspection endpoint. Looking for a solution for this Auth0, but seems that for Auth0 opaque tokens are default.
https://community.auth0.com/t/introspection-endpoint-for-opaque-tokens-or-more-flexible-rules-to-get-clear-jwt-access-token/63866
After adding a somewhat random introspection endpoint "AUTH0_DOMAIN/well-known/jwks.json" no I get
WWW-Authenticate: Bearer realm="master", error="invalid_token", error_description="response indicates failure, status=404, body=Not found."

luoluoyuyu · 2023-12-01T02:25:06Z

Hi @shreemaan-abhishek @monkeyDluffy6017
Please assign this issue to me.

luoluoyuyu · 2023-12-05T06:35:55Z

Hi @Radu-Iuonac
I created a new issue for your problem.
#10592

luoluoyuyu · 2023-12-06T01:58:03Z

@moonming @shreemaan-abhishek @monkeyDluffy6017 @starsz
To fix this bug, I think we need to fix the upstream library.zmartzone/lua-resty-openidc#499
What do you think?

luoluoyuyu · 2023-12-20T05:38:50Z

I'll continue to finish the work on #7690 to fix this bug

Co-authored-by: Traky Deng <trakydeng@gmail.com> Co-authored-by: lyy <2424809934@qq.com>

juzhiyuan assigned membphis and nic-chen Oct 10, 2020

juzhiyuan transferred this issue from apache/apisix-dashboard Oct 15, 2020

juzhiyuan added the bug Something isn't working label Oct 15, 2020

juzhiyuan added the plugin label Oct 17, 2020

liuxiran closed this as completed Oct 22, 2020

tangjun2012 mentioned this issue Jan 6, 2021

bug: authenticate(): request to the redirect_uri path but there's no session state found #3200

Closed

apache deleted a comment from moonming Apr 7, 2022

membphis reopened this Apr 7, 2022

starsz mentioned this issue Apr 7, 2022

feat: As a user, I want to get a specific error log message instead of 500 and a bad error log when using openid-connect plugins with the wrong redirect_uri config #6803

Open

liweitianux mentioned this issue Aug 8, 2022

request to the redirect_uri path but there's no session state found nokia/kong-oidc#208

Open

liweitianux mentioned this issue Aug 16, 2022

fix(openid-connect): the default 'redirect_uri' (#2426) #7690

Merged

5 tasks

brentmjohnson mentioned this issue Sep 30, 2022

openid-connect plugin leaving server-side sessions locked by not calling explicit session:close() #8017

Closed

MirtoBusico mentioned this issue Jun 7, 2023

help request: OpenID plugin error: "request to the redirect_uri path but there's no session state found" #9609

Closed

Radu-Iuonac mentioned this issue Sep 21, 2023

bug: openid-connect: accessing an authenticated resource gives a 302 html error instead of 200 #9935

Closed

monkeyDluffy6017 assigned luoluoyuyu and unassigned starsz Dec 1, 2023

luoluoyuyu mentioned this issue Dec 3, 2023

fix: modify the default 'redirect_uri' for openid-connect #10586

Closed

5 tasks

arulrajnet mentioned this issue Dec 10, 2023

Fix the discovery failure arulrajnet/apisix-oidc-keycloak#1

Merged

moonming closed this as completed in #7690 Dec 22, 2023

moonming pushed a commit that referenced this issue Dec 22, 2023

fix(openid-connect): the default 'redirect_uri' (#2426) (#7690)

c7d406d

Co-authored-by: Traky Deng <trakydeng@gmail.com> Co-authored-by: lyy <2424809934@qq.com>

bug：enable openid-connect plugin without redirect_uri got 500 error #2426

bug：enable openid-connect plugin without redirect_uri got 500 error #2426

Comments

liuxiran commented Oct 10, 2020

Bug

juzhiyuan commented Oct 10, 2020

membphis commented Oct 11, 2020

juzhiyuan commented Oct 15, 2020

nic-chen commented Oct 16, 2020

membphis commented Oct 17, 2020

fukiki commented Oct 19, 2020

moonming commented Oct 21, 2020

membphis commented Oct 21, 2020

moonming commented Oct 21, 2020

membphis commented Oct 22, 2020 • edited

liuxiran commented Oct 22, 2020

tangjun2012 commented Jan 5, 2021

lemonrains commented Nov 25, 2021

lemonrains commented Nov 25, 2021

membphis commented Nov 27, 2021

david-woelfle commented Apr 6, 2022

moonming commented Apr 6, 2022

membphis commented Apr 7, 2022

starsz commented Apr 7, 2022

starsz commented Apr 7, 2022

spacewander commented Aug 8, 2022

liweitianux commented Aug 8, 2022

jaysonsantos commented Aug 12, 2022

spacewander commented Aug 14, 2022 • edited

kingluo commented Oct 1, 2022 • edited

canob commented May 27, 2023 • edited

Xarxavier commented May 29, 2023 • edited

canob commented May 29, 2023

juzhiyuan commented Sep 6, 2023

Radu-Iuonac commented Sep 19, 2023 • edited

moonming commented Sep 20, 2023

kayx23 commented Sep 20, 2023 • edited

Radu-Iuonac commented Sep 20, 2023

Radu-Iuonac commented Sep 20, 2023

luoluoyuyu commented Dec 1, 2023

luoluoyuyu commented Dec 5, 2023

luoluoyuyu commented Dec 6, 2023

luoluoyuyu commented Dec 20, 2023

membphis commented Oct 22, 2020 •

edited

spacewander commented Aug 14, 2022 •

edited

kingluo commented Oct 1, 2022 •

edited

canob commented May 27, 2023 •

edited

Xarxavier commented May 29, 2023 •

edited

Radu-Iuonac commented Sep 19, 2023 •

edited

kayx23 commented Sep 20, 2023 •

edited