gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-19 06:46:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sso): forward RFC 9207 iss parameter in OIDC callback (#1785)

Browse Source 
* fix(sso): forward RFC 9207 iss parameter in OIDC callback

The Custom OIDC callback only forwarded code and state from the query
string to the token exchange, silently dropping the iss parameter that
issuer-identification-aware providers (Keycloak 22+, and others) add
to the redirect. openid-client rejects the exchange as an invalid
response once discovery advertises support for that parameter, so
login failed for any such provider.

* fix(sso): forward RFC 9207 iss parameter in OIDC callback

The Custom OIDC callback only forwarded code and state from the query
string to the token exchange, silently dropping the iss parameter that
issuer-identification-aware providers add to the redirect. openid-client
rejects the exchange as an invalid response once discovery advertises
support for that parameter (confirmed on Keycloak 26), so login failed
for any such provider.

Also logs the underlying openid-client error cause on callback failure
instead of only the generic message it collapses specific validation
errors into, since that cause carries the actual diagnosis.

* refactor(sso): dedupe iss-forwarding test setup

Extracts the shared callback-with-stubbed-service setup used by both
new regression tests into one helper.
This commit is contained in:
Anso
2026-08-07 23:04:27 -04:00
committed by GitHub
parent 89b16b97d1
commit e084ad424c
3 changed files with 103 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/SSOService.ts
+20 -5
View File
@@ -387,10 +387,23 @@ export class SSOService {
return { url: url.href, state, codeVerifier };
}
/** Builds the URL passed to authorizationCodeGrant() for response validation.
* Providers that support RFC 9207 issuer identification (confirmed on
* Keycloak 26; likely others) include `iss` in the callback. openid-client
* requires it once the provider's discovery metadata advertises support, so
* it must be forwarded here or the callback fails with "invalid response". */
public buildTokenExchangeUrl(callbackUrl: string, params: { code: string; state: string; iss?: string }): URL {
const url = new URL(callbackUrl);
url.searchParams.set('code', params.code);
url.searchParams.set('state', params.state);
if (params.iss) url.searchParams.set('iss', params.iss);
return url;
}
public async handleOIDCCallback(
provider: string,
callbackUrl: string,
params: { code: string; state: string },
params: { code: string; state: string; iss?: string },
expectedState: string,
codeVerifier: string
): Promise<SSOAuthResult> {
@@ -402,9 +415,7 @@ export class SSOService {
try {
const oidcConfig = await this.getOIDCConfig(provider, config);
const currentUrl = new URL(callbackUrl);
currentUrl.searchParams.set('code', params.code);
currentUrl.searchParams.set('state', params.state);
const currentUrl = this.buildTokenExchangeUrl(callbackUrl, params);
const tokens = await authorizationCodeGrant(oidcConfig, currentUrl, {
pkceCodeVerifier: codeVerifier,
@@ -473,7 +484,11 @@ export class SSOService {
};
} catch (err) {
const message = err instanceof Error ? err.message : 'OIDC authentication failed';
console.error('[SSO] OIDC callback error:', message);
// openid-client collapses specific validation failures (e.g. a missing or
// mismatched "iss" parameter) into this generic message; the cause carries
// the actual reason and is essential for diagnosing callback failures.
const cause = err instanceof Error && err.cause instanceof Error ? ` (${err.cause.message})` : '';
console.error('[SSO] OIDC callback error:', message + cause);
return { success: false, error: 'Authentication failed. Please try again.' };
}
}