Since this is a serialization issue I would say there are lots of ways of reproducing this.
We are using the PKCE flow in several apps. And we wanted to mimic the prompt=select_account behaviour. For that we are using the prompt=login parameter to send users to the login screen (https://github.com/ory/hydra/issues/1943). This allows our users to easily switch accounts, but this also makes the oidc_context.id_token_hint_claims to be filled.
Log in with a user: goes back to app with a valid token. ✅
Log in with another user: goes back to app with a valid token. ✅
Refresh the screen: this error happens. ❌
Relevant log output
json: cannot unmarshal string into Go struct field OpenIDConnectContext.oidc_context.id_token_hint_claims of type map[string]interface {}
Relevant configuration
No response
Version
1.11.8
On which operating system are you observing this issue?
Preflight checklist
Describe the bug
Some of our requests to the
/admin/oauth2/auth/requests/login
endpoint are returning an unmarshal error after upgrading to1.11.8
.After some debugging I found out that it fails every time Hydra returns a non-empty
oidc_context. id_token_hint_claims
field. According to the spec this field should be an object that contains any kind of field. But the model is defined as follows: https://github.com/ory/sdk/blob/5bc3139802ce7103ee9a5426f161d47ed1763283/clients/hydra/go/model_open_id_connect_context.go#L25Reproducing the bug
Since this is a serialization issue I would say there are lots of ways of reproducing this.
We are using the PKCE flow in several apps. And we wanted to mimic the
prompt=select_account
behaviour. For that we are using theprompt=login
parameter to send users to the login screen (https://github.com/ory/hydra/issues/1943). This allows our users to easily switch accounts, but this also makes theoidc_context.id_token_hint_claims
to be filled.Relevant log output
Relevant configuration
No response
Version
1.11.8
On which operating system are you observing this issue?
macOS
In which environment are you deploying?
Docker
Additional Context
No response