Broken with latest version of oidc-client-js

[maxmantz]

Broken with latest version of oidc-client-js

[Mitgenosse]

Omg, that is a very good thing to know. I changed ${initialState.settings.AppContextPath}/callback to ${initialState.settings.AppContextPath}callback and it now works. This was driving me crazy the last few days!
Danke

[maxmantz]

What is the error message you're getting? Haven't updated my projects yet, will investigate over the weekend.

[sveinpg]

No error message, I'm just stuck at the callback page

[maxmantz]

Just upgraded my example app to oidc-client version 1.3.0 and the callback worked fine. Are you sure this isn't an issue on your side?

[sveinpg]

Ok, will look into it. Might be the auth-wrapper

[maxmantz]

Keep me posted in case your issue is somehow related to redux-oidc or its integration with the auth-wrapper.

[sveinpg]

Turned out that error occurred due to the newly added sub validation in oidc-client-js IdentityModel/oidc-client-js#302

[Mitgenosse]

I am also stuck in the /callback page.
Console error:

There was an error handling the token callback: No matching state found in storage Error: No matching state found in storage

This only happens when I include the oidcMiddleware using

    console.log('1', window.localStorage);
    const oidcMiddleware = createOidcMiddleware(userManager, () => true, false, `${initialState.settings.AppContextPath}/callback`);    
    console.log('2', window.localStorage);

And include it in the store. When I log window.localStorage, the localStorage is empty after creating the middleware.

I am using v2.2.1 of redux-oidc and 1.2.2 of oidc-client-js.

[maxmantz]

Clearing localStorage is the desired behavior to remove failed callback states put there by oidc-client. Can you share your userManager config?

[Mitgenosse]

The userManager is created via a helper function:

export const setupUserManager = (systemSettings) => {
    const portPart = window.location && window.location.port ? `:${window.location.port}` : '';
    const absoluteBasePath = `${window.location.protocol}//${window.location.hostname}${portPart}${systemSettings.AppContextPath}`;
    const userManagerConfig = {
        /* REQUIRED */
        authority: systemSettings.AuthAuthorityURI,
        client_id: 'client',
        redirect_uri: `${absoluteBasePath}callback`,
        response_type: 'token id_token',
        scope: 'openid profile email',

        /* OPTIONAL */
        logout_redirect_uri: `${absoluteBasePath}error`,
        automaticSilentRenew: true,
        silent_redirect_uri: `${absoluteBasePath}silent_renew.html`,
        filterProtocolClaims: true,
        loadUserInfo: true
    };
    return new UserManager(userManagerConfig);
};

When redirecting from my login page to the central login, I see the oidc.[...] in the localstorage being set correctly. When I was successfully authenticated, I get redirected to the callback page but when creating the middleware, the storage gets deleted before the CallbackBack (with the CallbackComponent) can do it's signinRedirectCallback.
I think that is why it cannot find the state.
EDIT: I checked it again, without the creation of the oidcMiddleware (using createOidcMiddleware), the login works and the localStorage does not get cleared. Log 2*22 still logs the correct localStorage.

[maxmantz]

From your config it looks like you're using the default storage mechanism of the userManager which is sessionStorage. localStorage is only used to manage redirection by the userManager. The middleware clears this temporary data when the current URL of your app is not equal to the argument you pass into the creator function - ${initialState.settings.AppContextPath}/callback in your case. This is done to clear out any leftover data of failed login attempts and to avoid an unnecessary overflow of localStorage.

If your login worked you can look into sessionStorage and see the data there. From afar, I guess that whatever ${initialState.settings.AppContextPath}/callback resolves to is not equal to the actual callback URL of your app.

[maxmantz]

FYI - the reason for clearing localStorage is because of this bug.

[maxmantz]

Immer gerne :)