An inconsistent state error was raised when hydra combined with apisix #3884
Unanswered
bangbangDong
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
environment:
docker apache/apisix:3.9.0-debian
hydra2.2.0 deployed locally
How to reproduce:
Install hydra2.2.0 by following the local installation documentation
Follow the 5-min quickstart method to create a client
The OICD process built with the following methods works properly
hydra perform authorization-code --client-id $code_client_id --client-secret $code_client_secret --endpoint http://10.1.9.120:4444/ --port 5555 --scope openid --scope offline
apisix is set to:
curl http://127.0.0.1:9180/apisix/admin/routes/1
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri":"/*",
"plugins":{
"openid-connect":{
"client_id":"bdd480db-4371-4f0d-bf8b-0e87291e7159",
"client_secret":"0hgsS1UpC7p~d.d.jC6rOKM9Pb",
"discovery":"http://10.1.9.120:4444/.well-known/openid-configuration",
"scope":"openid",
"token_endpoint_auth_method": "client_secret_basic",
"bearer_only": false,
"redirect_uri":"http://127.0.0.1:9080/callback"
}
},
"upstream":{
"type":"roundrobin",
"nodes":{
"10.1.9.120:8083":1
}
}
}'
After http://127.0.0.1:3000/consent select openid and click allow access complains:
2024/11/14 16:57:18 [error] 49#49: *29151 [lua] openidc.lua:1106: authenticate(): state from argument: e08794a8d1d74021a40a86fbd32c280b does not match state restored from session: nil, client: 172.19.0.1, server: _, request: "GET /callback?code=ory_ac_T5FOnA0xRqtkpOVQAo1HqsLQ2m2sEpKpisKBClEagSU.zV8DjeILdifnTUgn1eEgLPBYr7j75n610w-b4Ov05Hs&scope=openid&state=e08794a8d1d74021a40a86fbd32c280b HTTP/1.1", host: "127.0.0.1:9080", referrer: "http://10.1.9.120:3000/"
2024/11/14 16:57:18 [error] 49#49: *29151 [lua] openid-connect.lua:555: phase_func(): OIDC authentication failed: state from argument does not match state restored from session, client: 172.19.0.1, server: _, request: "GET /callback?code=ory_ac_T5FOnA0xRqtkpOVQAo1HqsLQ2m2sEpKpisKBClEagSU.zV8DjeILdifnTUgn1eEgLPBYr7j75n610w-b4Ov05Hs&scope=openid&state=e08794a8d1d74021a40a86fbd32c280b HTTP/1.1", host: "127.0.0.1:9080", referrer: "http://10.1.9.120:3000/"
2024/11/14 16:57:18 [warn] 49#49: *29151 [lua] plugin.lua:1160: run_plugin(): openid-connect exits with http status code 500, client: 172.19.0.1, server: _, request: "GET /callback?code=ory_ac_T5FOnA0xRqtkpOVQAo1HqsLQ2m2sEpKpisKBClEagSU.zV8DjeILdifnTUgn1eEgLPBYr7j75n610w-b4Ov05Hs&scope=openid&state=e08794a8d1d74021a40a86fbd32c280b HTTP/1.1", host: "127.0.0.1:9080", referrer: "http://10.1.9.120:3000/"
172.19.0.1 - - [14/Nov/2024:16:57:18 +0800] 127.0.0.1:9080 "GET /callback?code=ory_ac_T5FOnA0xRqtkpOVQAo1HqsLQ2m2sEpKpisKBClEagSU.zV8DjeILdifnTUgn1eEgLPBYr7j75n610w-b4Ov05Hs&scope=openid&state=e08794a8d1d74021a40a86fbd32c280b HTTP/1.1" 500 249 0.000 "http://10.1.9.120:3000/" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0" - - - "http://127.0.0.1:9080"
How should I modify it?
Beta Was this translation helpful? Give feedback.
All reactions