History / Issue 117 Sign In Redirected To The Wrong Address

Two write-ups: #117 sign-in redirect, and the demo data account deletion Issue-117-Sign-In-Redirected-To-The-Wrong-Address - the reported OIDC redirect, whose cause turned out to be IIS ARR on the reporter's side. Written up anyway because the way it was settled is the useful part: the report named a FreeITSM code path that does not exist, and reading the provider's own discovery document answered it in one step. Covers the relative-Location shape that was guarded against regardless, and the diagnostic that was itself naming the wrong culprit. Demo-Data-Deleted-Real-Accounts - the same reporter, immediately afterwards, and much worse. Three faults: an importer that could not tell its own rows from real ones, foreign key checks turned off so the cascades never fired, and a sign-in that resolves by identity link first and treated that lookup succeeding as proof the account existed. Includes the sweep that found the same shape in the LDAP path (four branches, not two), the opcache mistake during verification that accidentally demonstrated the fix on a real database, and a section on what is still not fixed. Both added to Bugs-Resolved and to _Sidebar. All links and every file path named in the pages validated.

edmozley committed Aug 30, 2026