Missing State - Keycloak IDP - Social Login

[srikar-cogent]

Hello,

We are using keycloak as an IDP and could able to login into Wordpress through keyclok login as a normal user. If I am logging in as a social user then getting missing state issue. It seems like this is a redirection issue.

Can you suggest on how to resolve this issue. This plugin is behaving properly for logging as normal user but not as a google user.

Srikar

[timnolte]

If I understand your flow correctly, are you saying that your Keycloak is setup to allow users to authenticate via a third party IDP, like Facebook/Twitter/etc? If this is the case then Keycloak is acting as an OpenID Connect Relay, and you need to ensure that Keycloak is passing the state to the third party IDP so that it is then passed back to the WordPress endpoint.

[srikar-cogent]

Thanks Tim for your quick response.

Yes. Keycloak is setup to allow users to authenticate via a third party IDP like facebook, LinkedIn and google. There is no issue in signing up directly but have an issue with using third party IDP.

1. Login with IDP (Google) https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize?login-error=missing-state&message=Missing+state.

2. If I click again login -- then its logging in without asking for password -- Its saying that you are logged in -- continue

3. Is it a problem with redirection?

Please suggest

--Srikar

[srikar-cogent]

Tim,

I have figured out the problem.

When we are using to login through third party IDP, its appending "#38;" If that gets removed then its logging in properly.

How to remove "#38;" from url?

"#38;" should be removed from below

https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize?login-error=missing-state&message=Missing+state.

The URL that works:
https://www.example.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&;scope=openid%20email&client_id=GSCMS_CA&state=3a206cbdafb783bfb6c3a86dae03ac53&redirect_uri=https%3A%2F%2Fwww.example.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize -- This is working after removing "#38;" from URL.

Srikar

[srikar-cogent]

Tim,
We have used this function for proper redirection in functions.php

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
add_filter( 'login_url', 'get_login_url', 10, 2 );

If I change from esc_url to esc_url_raw and its still not working.
Can you please suggest what needs to be done to make it work.

--Srikar

[timnolte]

I believe the problem here is that the URL is being double escaped, you shouldn't be escaping the URL we are providing.

[srikar-cogent]

Tim,

The only function we are using for this plugin is for redirecting url which is working fine for normal login. I am not a word press developer. Do we need to make changes to this code in order to make it work.

I have removed the below function from functions.php and tested it to check whether its working but the same issue.

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

Default plugin is giving this error.

--Srikar

[srikar-cogent]

Tim -- Can you please guide here on what needs to be done.

[timnolte]

@srikar-cogent are you saying that the URL that the plugin is generating sometimes includes those characters? Have you reviewed/inspected the page source to determine what is being generated on the WordPress site for the IDP(Keycloak) authentication URL before making the trip to the IDP(Keycloak)? I still believe you have a relay issue where Keycloak is changing the URL when sending to you social media platforms.

[srikar-cogent]

Thanks Tim. You are so nice. Let me figure that one out and get back to you.

We also have another redirection issue...

www.example.com/career-advice --- User login from this page and should come back to this page -- Not working as its appending www.example.com/career-advice/career-advice

www.example.com/career-advice/Post1 -- User login from this page Post1 and coming back to post1 -- working as expected.
www.example.com/career-advice/Post2 -- User login from this page Post2 and coming back to post2 -- working as expected.

site url: www.example.com/career-advice
wordpress url: www.example.com/career-advice

The code that we have used in functions.php is:

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

We have followed this #257 but still getting an issue on home page redirection..

Please advise.

[srikar-cogent]

Tim -- Did you get a chance to look into the above issue? I see that you are working on Open ID redirection issues in the future releases. Does it solve the above problem?

--Srikar

[timnolte]

@srikar-cogent I have not looked into anything. Since you are only providing my "example.com" URLs there is nothing for me to look at. You will have to look at what is being set in the redirect cookie, from the Developer Console, when you visit your www.example.com/career-advice page. This would most likely have something to do with your use of home_url( $wp->request ). I am working on some redirect issues but it has to do with redirects using cookies being the issue and no so much what the redirect is being set to.

[srikar-cogent]

Tim -- Currently the cookie is set to https://www.example.com/career-advice/career-advice/. Looks like I need to make use of openid-connect-generic-cookie-redirect-url to setup redirect URI properly.

[timnolte]

@srikar-cogent I don't think you should be using $wp->request in your call.

[srikar-cogent]

Tim -- We have tried all possible ways from keycloak and its not removing #38 if its a social login. We have tried to login with the same url into the java application by changing the redirect uri and its working with no issues but we are getting this issue on wordpress saying "?login-error=missing-state&message=Missing+state".

We are running out of options and see if you can help.

--Srikar.

[timnolte]

@srikar-cogent have you confirmed what the URL is that is being output for your login button. What does the URL look like when you get to Keycloak before selecting the third party Identity Provider for performing the authentication?

[timnolte]

@srikar-cogent OK, a quick verification confirmed that you are double encoding the URL. The & is the URL encoded version of &. You need to remove any extra encoding or sanitization that you are doing.

[srikar-cogent]

Tim — Here is the url that we are using for social login.

https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&client_id=GSCMS_CA&scope=openid+profile+email&kc_idp_hint=google&nonce=891161af-7161-454a-8922-c4b87f68a394&login=true&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize

If we change the redirect uri then it gets getting logged into properly into our java application as I said.

We are using default plugin code and not doing anything to double encoding the url.

[timnolte]

@srikar-cogent so I took a look at your site and the URL being generated and output on the main site for the Login button is https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=04c0f5ba59e30b7787d19a4f580a0c83&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize as expected. However, you are using something else and that is the problem. You are somehow generating additional "Login with Facebook"/"Login with Google"/"Login with LinkedIn" buttons. Those buttons are the problem and whatever code you are using in the "broker"(openInPopUp('/auth/realms/GradSiren-V2.0/broker/google/login?client_id=GSCMS_CA&tab_id=amqgVFUIycM&session_code=730kUMUmGiKXigQvUSy3s5P3ZxlyRIvoVH9hZKCvhyU', 'Sign In')) that is doing the social logins.

[timnolte]

@srikar-cogent so looking at things it appears that you have both a WordPress install and a Keycloak install on the same domain? This means that what you have is Keycloak setup as a proxy for the Facebook/Google/LinkedIn SSO logins. This means the problem with the URLs is being caused by Keycloak and not the WordPress plugin.

[srikar-cogent]

Tim -- When we are trying to social login we are getting this issue:

https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=GSCMS_CA&state=87ae054a45099f77c6e0849f61504900&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize?login-error=missing-state&message=Missing+state

Looks like "missing state" is the error showing in the url. If you click on the "login" button again more time its signing up automatically without asking for credentials.

Wordpress Social Login URL:

https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&client_id=GSCMS_CA&scope=openid+profile+email&kc_idp_hint=google&nonce=96c7af48-8a15-494b-ba5a-565f1d7c0bfa&login=true&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize

Front-end Social Login URL:

https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/auth?response_type=code&client_id=angular_client&scope=openid+profile+email&kc_idp_hint=google&nonce=1f7040f8-fb61-4be3-aec1-14015302e983&login=true&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fjobseeker%2Fjshome%3Frole%3Djobseeker

Keycloak is generating social login urls properly in my opinion. The difference between both the urls above are mostly the redirect uri.

--Srikar

[srikar-cogent]

Tim -- We have figured out the issue. We are using ithemes pro which changed the login and logout URL.

redirect_uri is now = https://www.gradsiren.com/career-advice/wp-admin/admin-ajax.php?action%3Dopenid-connect-authorize

If we change it to https://www.gradsiren.com/career-advice/ithemesfd/wp-admin/admin-ajax.php?action%3Dopenid-connect-authorize -- then it's working.

Can you suggest how to change the redirect URI?

Once again thanks for your help and great support.

--Srikar

[srikar-cogent]

Hello Tim -- Do you have any recommendations on how to change redirect URI by just adding one extra folder.

If we change it to https://www.gradsiren.com/career-advice/**ithemesfd**/wp-admin/admin-ajax.php?action%3Dopenid-connect-authorize -- then it's working.

[srikar-cogent]

How to change the path of redirect uri from

https://www.gradsiren.com/career-advice/openid-connect-authorize
to
https://www.gradsiren.com/career-advice/ithemesfd/openid-connect-authorize

[srikar-cogent]

Hello Tim and Daggerhart -- We are stuck at this point. Can you guys help?

[daggerhart]

@srikar-cogent Getting caught up on this. Looks like there is not a way to change the alternate redirect_uri at this time. I'm currently in the middle of a site launch and can't go much further, but I submitted an untested proof of concept PR #286. If you want to review that and test it with your use case, that would be great.

[timnolte]

@srikar-cogent I have a PR that should be addressing some issues with redirection, however, the PR that @daggerhart worked up will need to be looked at and incorporated separately.

[srikar-cogent]

Tim -- We have removed ithemes completely and reinstalled back with "no hiding" functionality which is working fine. The redirection is not working properly as part of the plugin as we have written a separate code in the functions.php for the login process which is working:

function get_login_url($login_url=false, $redirect=false) {
global $wp;
return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

But our problem still persists with registration

https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/registrations?response_type=code&client_id=GSCMS_CA&scope=openid%20email&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fgswpwyfl17%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize

If you come from

1. https://www.gradsiren.com/career-advice/difference-between-an-internship-and-apprenticeship/
2. click signup
3. then it takes you to https://www.gradsiren.com/career-advice instead of https://www.gradsiren.com/career-advice/difference-between-an-internship-and-apprenticeship/

Do you have any suggestions for the redirection of the registration process?

Daggerhart --

I have tested by adding this to the functions.php

add_filter( 'openid-connect-generic-alter-alternate-redirect-uri', function( $redirect_uri ) {
// No preceeding or trailing slash.
return 'https://www.gradsiren.com/career-advice/ithemesfd/openid-connect-authorize';
} );

It's not working and not even taking to the keycloak login page.

We have resolved the redirection issue by removing that hiding login from ithemes which would be an easier option at this point.

--Srikar

[timnolte]

@srikar-cogent there are a bunch of Redirection fixes in the pending PR(#289) I worked on yesterday, and just finished up tonight, Once this PR is merged in and we can deploy a new version of the plugin redirection should be handled properly.

[srikar-cogent]

Thanks, Tim for your quick response. You are awesome.

[timnolte]

@srikar-cogent also, note that unless you manually updated the plugin also with the changes that @daggerhart added in his PR the openid-connect-generic-alter-alternate-redirect-uri isn't even available. However, if you did add that code then there may be more required as @daggerhart mentioned that he hadn't tested the code. Once the redirection fixes are put into place we can look at implementing that next piece. Thanks!

[srikar-cogent]

Make sense Tim. I don't want to make any changes to the plugin myself as it might break something as we are good for now.

[timnolte]

@srikar-cogent new version of the plugin has been released. Give it a try and let us know how it's working for you.

[srikar-cogent]

Tim,

The redirection is not working.

I have used this for login button -- do_shortcode("[openid_connect_generic_auth_url]

Step 1. https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/
Step 2. Click Login
Step 3. It's taking back to https://www.gradsiren.com/career-advice Instead of https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/

I have removed this code in functions.php which I have used in the past to make the redirection work properly.

/*
function get_login_url($login_url=false, $redirect=false)
{
global $wp;

return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );
*/

Please let me know what you think. You can also test it from your end also.

[timnolte]

@srikar-cogent do you have the "Redirect Back to Origin Page" plugin setting turned on?

[timnolte]

@srikar-cogent OK, I need to do some digging as my test site is not working also with the option turned on and so I'm thinking there is an issue with the redirect URL not getting picked up from the transient or something. I might need to push out another release. Stand by.

[srikar-cogent]

Yes "Redirect Back to Origin Page" is ON

[timnolte]

@srikar-cogent just a heads up that I have another PR, tested fully with and IDP and the Redirect Back setting is fully working as expected. Should have this released in the next few days at the latest.

[srikar-cogent]

Tim -- Please let me know once the code is pushed into production so I can test it.

[timnolte]

@srikar-cogent latest version with fixes has been release. Give it another try, thanks!

[srikar-cogent]

Tim -- Same issue not working.

---

The redirection is not working.

I have used this for login button -- do_shortcode("[openid_connect_generic_auth_url]

Step 1. https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/
Step 2. Click Login
Step 3. It's taking back to https://www.gradsiren.com/career-advice Instead of https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/

I have removed this code in functions.php which I have used in the past to make the redirection work properly.

/*
function get_login_url($login_url=false, $redirect=false)
{
global $wp;

return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );
*/

Please let me know what you think. You can also test it from your end also.

[timnolte]

@srikar-cogent can you explain what doesn't work. I've tested all of the most recent code and it should be working as expected unless you are using something non-standard to WordPress Core APIs or there is an issue with how you are inserting the login button.

[srikar-cogent]

The redirection is not working.

Step 1. https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/
Step 2. Click Login
Step 3. It's taking back to https://www.gradsiren.com/career-advice Instead of https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round/

Login code is do_shortcode("[openid_connect_generic_auth_url]

Please let me know your thoughts.

[timnolte]

@srikar-cogent do you have any object caching setup on your site? Also, can you install the Transienta Manager plugin and take a look at the redirect_to value set on the matching state transient for the login button that you are clicking on.

[srikar-cogent]

We have a CDN setup from stackpath. We haven't done anything special from the WordPress site. redirect_to_value is setup to https://www.gradsiren.com/career-advice instead of https://www.gradsiren.com/career-advice/best-interview-tips-for-face-to-face-round.

[timnolte]

Where do you have the do_shortcode("[openid_connect_generic_auth_url... call happening? What I'm not seeing on your beta site is what I assume is your login link in your menu just has a link to the /login page. It doesn't look like you are actually outputting the results of the authentication URL to be used by your login button. If you aren't going to be outputting the login button, or the authentication URL, directly on the page you are expecting the users to go back to, then you will need to supply the redirect_to argument when calling the shortcode supplying the correct redirect URL.

[srikar-cogent]

Thanks for your quick response.

If I use this in functions.php

function get_login_url($login_url=false, $redirect=false)
{
global $wp;

return esc_url(do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' ));
}
add_filter( 'login_url', 'get_login_url', 10, 2 );

and then calling login
get_login_url()

its working.

This is also working for previous versions also. I thought that new updates will work but looks like we need this in functions.php to make it work.

[srikar-cogent]

Tim,

The above one is working for the login URL. Is there any specific function for the registration url? We are using a keycloak registration URL but the redirection is not working.

for sign up (registration) we are using "https://www.gradsiren.com/auth/realms/GradSiren-V2.0/protocol/openid-connect/registrations?response_type=code&client_id=GSCMS_CA&scope=openid%20email&redirect_uri=https%3A%2F%2Fwww.gradsiren.com%2Fcareer-advice%2Fgswpwyfl17%2Fwp-admin%2Fadmin-ajax.php%3Faction%3Dopenid-connect-authorize"

[timnolte]

@srikar-cogent I'm still not quite clear on where you were calling the do_shortcode( '[openid_connect_generic_auth_url... before when you said it wasn't working, but so long as it's working now it seems like you are calling it correctly. On my test site(https://oidc-wp.ndigitals.com/login-page-test/) I am simply outputting the button shortcode on a standard page using the Gutenberg shotcode block and this was what I was using in my testing.

[srikar-cogent]

we are calling this (do_shortcode( '[openid_connect_generic_auth_url...) in header.php file under themes folder.

[srikar-cogent]

is there any shortcode for user registration just like login?
do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' )

[srikar-cogent]

Tim -- I have used this code in functions.php to make it work but its not working

add_filter( 'registration_redirect', 'redirect_after_registration' );
function redirect_after_registration()
{
// change the slug below with desired page slug
return home_url( '/new-user-registration/' );
}

we are sending to a keycloak registration page but not to a wordpress registration page (action=register in wp_login.php).

[timnolte]

is there any shortcode for user registration just like login?
do_shortcode( '[openid_connect_generic_auth_url redirect_to="'.home_url( $wp->request ).'" ]' )

@srikar-cogent there isn't any shortcode for registration as that would to a degree be out of scope for SSO since users generally get created though the IDP. To be honest your use of this plugin to perform Social Media platforms is a little bit out of the norm for the typical use of this plugin. Most people implementing the plugin are using a single IDP for central user management. Generally this plugin is used to provide a login button that takes users directly to the IDP authentication endpoint to login. The plugin does of course provide auto-provisioning of new users that have authenticated to the IDP, which is the feature I'm assuming you are using with the Social Media platforms.