Automattic / Automattic/jetpack
Custom roles get stuck in loop during Jetpack SSO login; are ultimately logged in
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
#### Steps to reproduce the issue
1. Go a site that forces Jetpack SSO for all logins and has custom roles (example.com)
2. Attempt to log in as a user with that custom role for the first time by going to wp-login.php (example.com/wp-login.php). This should be a local user on the Jetpack site who 1) has a username and password on the site 2) has a WordPress.com account 3) has a custom role and 4) has never logged into this specific site before. You may be able to reproduce with an existing user, I'm not sure.)
3. Follow the Jetpack SSO flow
4. Login will apparently fail and continue retrying infinitely
5. Go back to the site's /wp-admin (example.com/wp-admin/ will redirect to example.com/wp-login.php)
6. See a missing token error
7. Go back to /wp-admin/ and get redirected to wp-login.php again
8. Login with the user's local username and password
9. Success
#### What I expected
I expected to be logged in with expected permissions (in this case, an administrator like user account) after step 3. OR if login wasn't successful, I expected to go to a standard wp-login form.
#### What happened instead
I was ultimately logged in but only after what felt like tricking Jetpack into giving me a standard login form.
**Internal reference**
p1587047165435500-slack-jpop-support
p9GBOq-1L4-p2
Contributor guide
Research direction
Start with the wp-login.php and /wp-admin/ paths described in the reproduction, then trace the Jetpack SSO flow for a first-time local user with a custom role. Compare the missing-token retry loop with the standard login fallback. Done means the user logs in through SSO with the expected permissions, or is sent to a standard login form when SSO fails.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100