joshp23 / YOURLS-OIDC

OpenID Connect Authentication for YOURLS
GNU General Public License v3.0
7 stars 6 forks source link

AzureAD auth works but all yourls functions are broken #15

Closed b-iten closed 11 months ago

b-iten commented 11 months ago

Hi there,

I have several problems using yourls with the oidc plugin. Instantly after activation of the plugin I cannot activate or deactivate any plugin anymore nor can I add a new short link, which is a bit annoying as it is the core feature of yourls ;-)

The redirect seems to be the problem as it strips off all the url args: If I call "https://mygreatdomain/admin/plugins.php?action=deactivate&plugin=oidc&nonce=whatever" I get redirected to https://mygreatdomain/admin/plugins.php?code=XXXX&state=YYYY&session_state=ZZZZ# And if I set a static redirection url it really seems to be completely static: $oidc->setRedirectUrl(https://mygreatdomain/admin/); seems to point any page I'd like to load to the main admin page. This seems somehow correct but there are users out there setting the redirectUrl to the /admin/ and not having the problems I have it seems.

I also implemented the pull request #11 which is nice for not having to map users but it doesn't help me with the problems mentioned above.

Thanks, Ben

b-iten commented 11 months ago

Dear All

I just realized I failed to implement #11 correctly as I did not patch it but added the code by hand (copy paste). Adding the oidc_cookie_login($user); on line 52 instead of 43 lead to a strange behaviour which is completely gone after implementing the PR correctly. :-) Sorry for the inconvenience.

Cherrs, Ben