element-hq / element-hq/element-android
POST after talking to OIDC SSO server goes to server address, not base_url of homeserver where the API lives
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- Avg merge
- 8d 20h
- Merged PRs (30d)
- 1
Description
### Steps to reproduce
1. Have a setup with SSO, and a `.well-known/matrix/client` endpoint on the server name URL (example.tld) that points to a home server API URL (https://homeserver.example.tld).
2. Try to login. Observe the client correctly finding the .well-known configuration file (http log), and then observe it using the base_url of the homeserver when requesting `/_matrix/client/version` and `/_matrix/client/r0/login/sso/redirect/oidc-keycloak` (http log)
3. Have the client authenticate with keycloak (in this example)
4. Observe Keycloak instructing the client to redirect back to the same homeserver URL (homeserver.example.tld) as is configured in the .well-known config file (keycloak event log)
5. Fail: Observe the client POST to `/_matrix/client/r0/login` end up on the server name URL (example.tld), instead of the base_url that is supplied in the .well-known file (homeserver.example.tld), and by Keycloak.
### Outcome
#### What did you expect?
Client to use either redirect URL from OIDC communication with Keycloak, or at least the URL from the `.well-known/matrix/client` endpoint when POSTing auth info to `/_matrix/client/r0/login`.
#### What happened instead?
OIDC POST callback went to server name URL (example.tld) instead of API endpoint URL (https://homeserver.example.tld).
However, entering the server name as homeserver.example.tld into the app makes the flow work well. This seems to be a workaround for now.
### Your phone model
Pixel 3a and other tried
### Operating system version
Android 12 and others
### Application version and app store
1.5.26 [40105262] (G-f6379963) (Play Store latest) / SDK 1.5.26 (f6379963)
### Homeserver
Synapse 1.79.0
### Will you send logs?
No
### Are you willing to provide a PR?
No
Contributor guide
Assessment
This issue has not been assessed yet.