2509116b28
Some OIDC providers like Keycloak (v18+) include an `iss` (issuer) parameter in the authentication response for security (as per RFC 9207). The oidc route was explicitly extracting only `code` and `state`, thus losing the `iss` parameter and other potential parameters like `session_state`. When Jackson passed the incomplete set of parameters to `openid-client`, the library failed validation with the error `invalid response encountered` because it expected the `iss` parameter to be present if the server supports it. Fixes #22238. Co-authored-by: Sahitya Chandra <sahityajb@gmail.com>
42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import { defaultResponderForAppDir } from "app/api/defaultResponderForAppDir";
|
|
import type { NextRequest } from "next/server";
|
|
import { NextResponse } from "next/server";
|
|
|
|
import jackson from "@calcom/features/ee/sso/lib/jackson";
|
|
import { HttpError } from "@calcom/lib/http-error";
|
|
import logger from "@calcom/lib/logger";
|
|
|
|
// This is the callback endpoint for the OIDC provider
|
|
// A team must set this endpoint in the OIDC provider's configuration
|
|
async function handler(req: NextRequest) {
|
|
const log = logger.getSubLogger({ prefix: ["[OIDC auth]"] });
|
|
const { searchParams } = req.nextUrl;
|
|
const params = Object.fromEntries(searchParams.entries());
|
|
|
|
if (!params.code || !params.state) {
|
|
return NextResponse.json({ message: "Code and state are required" }, { status: 400 });
|
|
}
|
|
|
|
const { oauthController } = await jackson();
|
|
|
|
try {
|
|
const { redirect_url } = await oauthController.oidcAuthzResponse(params);
|
|
|
|
if (!redirect_url) {
|
|
throw new HttpError({
|
|
message: "No redirect URL found",
|
|
statusCode: 500,
|
|
});
|
|
}
|
|
|
|
return NextResponse.redirect(redirect_url, 302);
|
|
} catch (err) {
|
|
log.error(`Error authorizing tenant ${params.tenant}: ${err}`);
|
|
const { message, statusCode = 500 } = err as HttpError;
|
|
|
|
return NextResponse.json({ message }, { status: statusCode });
|
|
}
|
|
}
|
|
|
|
export const GET = defaultResponderForAppDir(handler);
|