rhysyngsun opened a new issue, #13776: URL: https://github.com/apache/apisix/issues/13776
### Current Behavior If the upstream provider redirects to apisix with a standard OAuth2 [error response](https://www.rfc-editor.org/info/rfc6749/#section-4.1.2.1) apisix will return a 500 error. Most of the error codes will end up being caused by some kind of misconfiguration, but the `temporarily_unavailable` code can occur when everything is nominal. One example we've run into is that when Keycloak's login attempt expires, it redirects back to apisix with `?error=temporarily_unavailable&error_description=authentication_expired` and this login attempt could be automatically retried. ### Expected Behavior It would be ideal to at least handle the `temporarily_unavailable` code, the others are probably fine as-is. For this code I think it's reasonable to reattempt the authentication. I was able to generate a plausible looking fix for this with Claude Code, I've spent a fair amount of time reading the openid-connect sources while dealing with shaking out bugs in our configuration so I have high confidence in the fix itself, the tests are a different matter because they look a bit verbose to my eyes. I've pushed this up to our fork here: https://github.com/mitodl/apisix/commit/4387527d0a90353beeaaff2dc37815d444e95b31 Happy to collaborate on getting this to a mergable state if that looks like it's in the right direction. ### Error Logs ``` openid-connect.lua:876: phase_func(): OIDC authentication failed: unhandled request to the redirect_uri: /login/.apisix/redirect?error=temporarily_unavailable&error_description=authentication_expired&state=...&iss=... ``` ### Steps to Reproduce 1. Run APISIX configured with the openid-connect plugin against a provider like Keycloak. 2. Attempt to login, but allow the login attempt to timeout (setting a low timeout helps make this happen faster). 3. Continue to login after the timeout has elapsed and get redirected to APISIX and hit the 500 error. ### Environment - APISIX version (run `apisix version`): 3.17.0 - Operating system (run `uname -a`): Linux apache-apisix-dc84694c8-2h8xc 6.18.38-76.139.amzn2023.x86_64 #2 SMP PREEMPT_DYNAMIC Fri Jul 24 13:38:05 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux - OpenResty / Nginx version (run `openresty -V` or `nginx -V`): openresty/1.29.2.4 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
