janiussyafiq opened a new pull request, #13825: URL: https://github.com/apache/apisix/pull/13825
### Description When the ID provider redirects back to the redirect_uri with a standard OAuth2 error response (RFC 6749 section 4.1.2.1) such as `?error=temporarily_unavailable&error_description=authentication_expired` (e.g. Keycloak after its login session expired), the plugin returned a dead-end 500 to the browser. The plugin now restarts the authentication flow for this transient error by redirecting the browser back to the original URL, where the retry typically completes without user interaction via the provider's SSO session. To keep this safe: - the retry only applies when resty.openidc reported an unhandled request to the redirect_uri, so other failures on a request carrying that query argument are still surfaced, and a session-less request cannot be redirected to itself - consecutive restarts of the authentication flow (shared with the existing state-mismatch restart) are capped at 3 per session, and the budget resets once a request authenticates Other OAuth2 error codes (`access_denied`, `login_required`, ...) reflect a deliberate outcome and are not retried. #### Which issue(s) this PR fixes: Fixes #13776 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
