Question : IDP initiated login.

[hasinthaindrajee]

Does this support IDP initiated login. I have my IDP which federates to external SAML based IDPs. The login initiates from external SAML IDP as an IDP initiated login request and My IDP validates the SAML response and starts an OIDC flow.

The very first request which comes to Nginx is the callback with authorization code. eg

http://localhost/_codexch?code=8ce41dc5-826a-31dd-a397-a95e7b56e86f&session_state=580285ece2a96c92ab7ac14ede00e581ac866e72644f6c78d774589e86fdccd3.AbPX_g1f9kt2u9BwwmYMpg

Nginx can't process this and it redirects the application to root context of nginx which is
http://localhost:80

Any possible solution to avoid this and start an IDP initiated login flow ?

[route443]

Hi @hasinthaindrajee ,

You need to check whether nginx is sending a request to the token endpoint as the next step. For example, something like this

POST /token
HTML Form URL Encoded: application/x-www-form-urlencoded
    Form item: "grant_type" = "authorization_code"
    Form item: "client_id" = "foo"
    Form item: "code" = "bar"
    Form item: "redirect_uri" = "http://localhost:8080/_codexch"
    Form item: "client_secret" = "secret"

If yes, then look at the op's response. If you receive a tokenset in the response, token validation will still fail because nginx won’t be able to verify the nonce claim as required by the standard. However, this can be bypassed if the auth_nonce cookie from your initial request matches the nonce claim from the id_token.