From 49c0c701eba99a15b6b31f87e188b5b1baf93ec5 Mon Sep 17 00:00:00 2001 From: waterWang Date: Fri, 7 Aug 2026 02:29:13 +0800 Subject: [PATCH] fix(openid-connect): handle temporarily_unavailable from IDP by restarting auth flow (#13776) --- apisix/plugins/openid-connect.lua | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/apisix/plugins/openid-connect.lua b/apisix/plugins/openid-connect.lua index 3cf05e0fd4a3..1163f1925a74 100644 --- a/apisix/plugins/openid-connect.lua +++ b/apisix/plugins/openid-connect.lua @@ -913,6 +913,27 @@ function _M.rewrite(plugin_conf, ctx) return 302 end + -- Transient authorization error from the identity provider: the ID + -- provider redirected to the redirect_uri with + -- error=temporarily_unavailable instead of a code, e.g. Keycloak's + -- login session expiring before the user completed authentication. + -- This is recoverable, so restart the authentication flow by + -- sending the browser back to the original URL instead of + -- dead-ending with a 500. Other error codes (access_denied, + -- login_required, ...) are not retried here, since they reflect a + -- deliberate outcome rather than a transient failure. + local uri_args = ngx.req.get_uri_args() + if uri_args.error == "temporarily_unavailable" and target_url + and ngx.req.get_method() == "GET" then + core.log.warn("OIDC authorization callback reported a temporarily ", + "unavailable identity provider", + uri_args.error_description and + (" (" .. uri_args.error_description .. ")") or "", + ", restarting the authentication flow") + core.response.set_header("Location", target_url) + return 302 + end + core.log.error("OIDC authentication failed: ", err) return 500 end