Missing State - Keycloak IDP - Social Login

[srikar-cogent]

Hello,

We are using keycloak as an IDP and could able to login into Wordpress through keyclok login as a normal user. If I am logging in as a social user then getting missing state issue. It seems like this is a redirection issue.

Can you suggest on how to resolve this issue. This plugin is behaving properly for logging as normal user but not as a google user.

Srikar

[timnolte]

If I understand your flow correctly, are you saying that your Keycloak is setup to allow users to authenticate via a third party IDP, like Facebook/Twitter/etc? If this is the case then Keycloak is acting as an OpenID Connect Relay, and you need to ensure that Keycloak is passing the state to the third party IDP so that it is then passed back to the WordPress endpoint.

[srikar-cogent]

Thanks Tim for your quick response.

Yes. Keycloak is setup to allow users to authenticate via a third party IDP like facebook, LinkedIn and google. There is no issue in signing up directly but have an issue with using third party IDP.

1. Login with IDP (Google) https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize?login-error=missing-state&message=Missing+state.

2. If I click again login -- then its logging in without asking for password -- Its saying that you are logged in -- continue

3. Is it a problem with redirection?

Please suggest

--Srikar

[srikar-cogent]

Tim,

I have figured out the problem.

When we are using to login through third party IDP, its appending "#38;" If that gets removed then its logging in properly.

How to remove "#38;" from url?

"#38;" should be removed from below

https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize?login-error=missing-state&message=Missing+state.

The URL that works:
https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&;scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize -- This is working after removing "#38;" from URL.

Srikar

[srikar-cogent]

Tim,
We have used this function for proper redirection in functions.php

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
add_filter( 'login_url', 'get_login_url', 10, 2 );

If I change from esc_url to esc_url_raw and its still not working.
Can you please suggest what needs to be done to make it work.

--Srikar

[timnolte]

I believe the problem here is that the URL is being double escaped, you shouldn't be escaping the URL we are providing.

[srikar-cogent]

Tim,

The only function we are using for this plugin is for redirecting url which is working fine for normal login. I am not a word press developer. Do we need to make changes to this code in order to make it work.

I have removed the below function from functions.php and tested it to check whether its working but the same issue.

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

Default plugin is giving this error.

--Srikar

[srikar-cogent]

Tim -- Can you please guide here on what needs to be done.

[timnolte]

@srikar-cogent are you saying that the URL that the plugin is generating sometimes includes those characters? Have you reviewed/inspected the page source to determine what is being generated on the WordPress site for the IDP(Keycloak) authentication URL before making the trip to the IDP(Keycloak)? I still believe you have a relay issue where Keycloak is changing the URL when sending to you social media platforms.

[srikar-cogent]

Thanks Tim. You are so nice. Let me figure that one out and get back to you.

We also have another redirection issue...

www.example.com/career-advice --- User login from this page and should come back to this page -- Not working as its appending www.example.com/career-advice/career-advice

www.example.com/career-advice/Post1 -- User login from this page Post1 and coming back to post1 -- working as expected.
www.example.com/career-advice/Post2 -- User login from this page Post2 and coming back to post2 -- working as expected.

site url: www.example.com/career-advice
wordpress url: www.example.com/career-advice

The code that we have used in functions.php is:

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

We have followed this #257 but still getting an issue on home page redirection..

Please advise.

[srikar-cogent]

Tim -- Did you get a chance to look into the above issue? I see that you are working on Open ID redirection issues in the future releases. Does it solve the above problem?

--Srikar

[timnolte]

@srikar-cogent I have not looked into anything. Since you are only providing my "example.com" URLs there is nothing for me to look at. You will have to look at what is being set in the redirect cookie, from the Developer Console, when you visit your www.example.com/career-advice page. This would most likely have something to do with your use of home_url( $wp->request ). I am working on some redirect issues but it has to do with redirects using cookies being the issue and no so much what the redirect is being set to.

[srikar-cogent]

Tim -- Currently the cookie is set to https://www.example.com/career-advice/career-advice/. Looks like I need to make use of openid-connect-generic-cookie-redirect-url to setup redirect URI properly.

[timnolte]

@srikar-cogent I don't think you should be using $wp->request in your call.