Hey, I found a bug when trying to login in an OIDC service.
When opening an OIDC service, the user gets redirected to the /authorize endpoint of the sso. If the user has no active sso session, he will get redirected to the login view. After logging in, he will be redirected to the /authorizeCallback endpoint followed by a redirect to the /authorize endpoint followed by a redirect to the OIDC service. *If *the user gets redirected to the login view and resides there, the bug occurs. A user may provide his credentials and login in when he takes less than 60s to do so. If instead, he needs more than 60s, he gets an error. This error is caused by the fact, that the user in put on a loop on the /authorizeCallback endpoint. Within the executed code of this endpoint, the Service Ticket gets validated which is usually only allowed once. Furthermore the URL for the next redirect is determined which should be the /authorize enpoint, but in the error cas, it is again the /authorizeCallback enpoint. To demonstrate this issue better, I've choosen to set the maximum allowed validations of the service ticket to 10 times. As the screenshot shows, the user gets 10 times redirected to the same endpoint with an 302 status code. The eleventh time he gets a 500 error. If I'd instead had used an maximum validation value of 1 - the second attempt would have failed. In the hope of getting this issue fixed for 6.1 - I made a fork of the cas overlay with a minimal setup so everyone may have look into it. https://github.com/Balder86/cas-overlay-template - after cloning you should make a symlink for the /etc/cas folder - start with ./gradlew run - open the URL https://localhost:8443/cas/oidc/authorize?client_id=dummyService&redirect_uri=https://localhost/auth/signin-oidc&response_type=id_token&scope=openid&state=9e1b54c6c01d4f478c1311026123e226&nonce=10425ca5106544c8adfc2a1172ce2f01 If you then login with the credentials casuser:Mellon within 60s everything is fine. If you reside for more than 60s on the login view, you will get the same error as I posted. Best Regards, Christian -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/539be314-0d09-4568-862e-f239412c7eda%40apereo.org.
