[Go][Hydra] client library error when decoding GetLoginRequest response that contains oidc context
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 178
- Forks
- 96
- Avg merge
- 6d 23h
- Merged PRs (30d)
- 3
Description
Preflight checklist
- I could not find a solution in the existing issues, docs, nor discussions.
- I agree to follow this project's Code of Conduct.
- I have read and am following this repository's Contribution Guidelines.
- This issue affects my Ory Network project.
- I have joined the Ory Community Slack.
- I am signed up to the Ory Security Patch Newsletter.
Describe the bug
Some of our requests to the /admin/oauth2/auth/requests/login endpoint are returning an unmarshal error after upgrading to 1.11.8.
After some debugging I found out that it fails every time Hydra returns a non-empty oidc_context. id_token_hint_claims field. According to the spec this field should be an object that contains any kind of field. But the model is defined as follows:
https://github.com/ory/sdk/blob/5bc3139802ce7103ee9a5426f161d47ed1763283/clients/hydra/go/model_open_id_connect_context.go#L25
Reproducing the bug
Since this is a serialization issue I would say there are lots of ways of reproducing this.
We are using the PKCE flow in several apps. And we wanted to mimic the prompt=select_account behaviour. For that we are using the prompt=login parameter to send users to the login screen (https://github.com/ory/hydra/issues/1943). This allows our users to easily switch accounts, but this also makes the oidc_context.id_token_hint_claims to be filled.
- Log in with a user: goes back to app with a valid token. ✅
- Log in with another user: goes back to app with a valid token. ✅
- Refresh the screen: this error happens. ❌
Relevant log output
json: cannot unmarshal string into Go struct field OpenIDConnectContext.oidc_context.id_token_hint_claims of type map[string]interface {}
Relevant configuration
No response
Version
1.11.8
On which operating system are you observing this issue?
macOS
In which environment are you deploying?
Docker
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with clients/hydra/go/model_open_id_connect_context.go, especially the id_token_hint_claims field, and inspect decoding for GET /admin/oauth2/auth/requests/login. Reproduce with a response containing a non-empty oidc_context.id_token_hint_claims value; done when that response decodes without the reported unmarshal error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100