element-hq / element-hq/element-android

POST after talking to OIDC SSO server goes to server address, not base_url of homeserver where the API lives

Open
#8,283 3 comments 1 reaction 0 assignees View on GitHub
A-Signin A-SSO O-Occasional S-Minor T-Defect Z-OIDC
Dominant language
Kotlin
Stars
3.7k
Forks
917
Avg merge
8d 20h
Merged PRs (30d)
1

Description

### Steps to reproduce

1. Have a setup with SSO, and a `.well-known/matrix/client` endpoint on the server name URL (example.tld) that points to a home server API URL (https://homeserver.example.tld).
2. Try to login. Observe the client correctly finding the .well-known configuration file (http log), and then observe it using the base_url of the homeserver when requesting `/_matrix/client/version` and `/_matrix/client/r0/login/sso/redirect/oidc-keycloak` (http log)
3. Have the client authenticate with keycloak (in this example)
4. Observe Keycloak instructing the client to redirect back to the same homeserver URL (homeserver.example.tld) as is configured in the .well-known config file (keycloak event log)
5. Fail: Observe the client POST to `/_matrix/client/r0/login` end up on the server name URL (example.tld), instead of the base_url that is supplied in the .well-known file (homeserver.example.tld), and by Keycloak.

### Outcome

#### What did you expect?
Client to use either redirect URL from OIDC communication with Keycloak, or at least the URL from the `.well-known/matrix/client` endpoint when POSTing auth info to `/_matrix/client/r0/login`.

#### What happened instead?
OIDC POST callback went to server name URL (example.tld) instead of API endpoint URL (https://homeserver.example.tld).

However, entering the server name as homeserver.example.tld into the app makes the flow work well. This seems to be a workaround for now.

### Your phone model

Pixel 3a and other tried

### Operating system version

Android 12 and others

### Application version and app store

1.5.26 [40105262] (G-f6379963) (Play Store latest) / SDK 1.5.26 (f6379963)

### Homeserver

Synapse 1.79.0

### Will you send logs?

No

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.