help request: OIDC requires two logins for proper authentication

[luoluoyuyu]

Description

configure

The configuration is as follows

curl -i "http://127.0.0.1:9180/apisix/admin/routes/1" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
{

  "uri":"/anything/*",
  "plugins": {
    "openid-connect": {
     "client_id": "'"$AUTH0_CLIENT_ID"'",
      "client_secret": "'"$AUTH0_CLIENT_SECRET"'",
      "discovery": "https://'"$AUTH0_DOMAIN"'/.well-known/openid-configuration",
      "scope": "openid profile",
      "logout_path": "/anything/logout",
      "redirect_uri": "http://localhost:9080/anything/callback"
    }
  },
  "upstream":{
    "type":"roundrobin",
    "nodes":{
      "httpbin.org:80":1
    }
  }
}'

Process description

The steps of the operation follow the documentation: https://docs.api7.ai/apisix/how-to-guide/authentication/set-up-sso-with-auth0

First time login

Redirects to http://localhost:9080/anything/callback after first successful login Returns 500，

Second login

To access '127.0.0.1:9080/anything/test' again, I need to log in once more, and unfortunately, I don't get redirected to /anything/callback after a successful login.

log：

 openidc.lua:1106: authenticate(): state from argument: 0dd075ce951900a6bdecbe123d8420e6 does not match state restored from session: nil,

Environment

• APISIX version (run apisix version):
• Operating system (run uname -a):
• OpenResty / Nginx version (run openresty -V or nginx -V):
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):

[shreemaan-abhishek]

can you confirm if there are no other routes that might be interfering with the route with OIDC plugin?

[kayx23]

Related: https://github.com/apache/apisix/issues/9131

But for that doc, I didn't run into state does not match state restored from session last I ran it. Is this behaviour reproducible if you start with a clean APISIX instance?

[luoluoyuyu]

hi @shreemaan-abhishek Only one route

{
  "list": [
    {
      "value": {
        "update_time": 1702177105,
        "id": "1",
        "status": 1,
        "priority": 0,
        "create_time": 1701853548,
        "plugins": {
          "openid-connect": {
            "scope": "openid profile",
            "client_id": "",
            "session": {
              "secret": ""
            },
            "set_id_token_header": true,
            "client_secret": "",
            "set_refresh_token_header": false,
            "introspection_endpoint_auth_method": "client_secret_basic",
            "ssl_verify": false,
            "token_endpoint_auth_method": "client_secret_basic",
            "bearer_only": false,
            "logout_path": "/anything/logout",
            "redirect_uri": "http://localhost:9080/anything/callback",
            "set_access_token_header": true,
            "client_jwt_assertion_expires_in": 60,
            "access_token_in_authorization_header": false,
            "use_pkce": false,
            "iat_slack": 120,
            "accept_none_alg": false,
            "accept_unsupported_alg": true,
            "use_nonce": false,
            "jwk_expires_in": 86400,
            "jwt_verification_cache_ignore": false,
            "access_token_expires_leeway": 0,
            "introspection_interval": 0,
            "set_userinfo_header": true,
            "realm": "apisix",
            "refresh_session_interval": 900,
            "renew_access_token_on_expiry": true,
            "unauth_action": "auth",
            "revoke_tokens_on_logout": false,
            "force_reauthorize": false,
            "timeout": 3,
            "discovery": "https://dev-4z571phginb1bucm.us.auth0.com/.well-known/openid-configuration"
          }
        },
        "uri": "/anything/*",
        "upstream": {
          "scheme": "http",
          "pass_host": "pass",
          "hash_on": "vars",
          "nodes": {
            "httpbin.org:80": 1
          },
          "type": "roundrobin"
        }
      },
      "key": "/apisix/routes/1",
      "modifiedIndex": 287,
      "createdIndex": 219
    }
  ],
  "total": 1
}

[Vacant2333]

i can reproduce it on my apisix

[kayx23]

Ok noted. I'll find time to take a look soon.

[kayx23]

Ok I can reproduce the no session state found as well. It didn't error out in review when we rolled out this doc so this is new. I'll investigate.

Please note that the originally reported ... does not match state restored from session is a different error. I have seen it before with other OP but not sure how to recreate for Auth0.

[kayx23]

@Vacant2333 try substituting 127.0.0.1 with localhost (so http://localhost:9080/anything/test)

[kayx23]

@luoluoyuyu the doc has been updated. Please see if your issue still persists.

[luoluoyuyu]

@kayx23 Thanks, problem solved!