Redirects fail after upgrading the OIDC SSO module from v4.0.1 or earlier to v4.4.0 or later

Issue

After upgrading the OIDC SSO module from v4.0.1 to v4.4.0, the OIDC login flow no longer correctly redirects to the originally requested URL. When accessing a page or microflow through a configured URL without an active session, authentication is completed successfully, but the redirect returns to the default landing page instead of the intended page or microflow.

The behavior can be reproduced using the following steps.

1. Navigate to https://mendix/p/my-tasks while not authenticated

2. Complete the login process successfully

3. It returns to https://mendix/p/my-tasks

Instead, after login is completed successfully, the redirect returns to the home page (for example, https://mendix/p/home) rather than the originally requested page.

The behavior works as expected with OIDC v4.0.1 but is reproducible with OIDC v4.4. The issue can also be reproduced on localhost.

Environment

OIDC SSO v4.1.0 or later

Cause

After upgrading the OIDC SSO module, the default login.html redirect logic no longer passes the originally requested deep-link URL (/p/<page>) to the /oauth/v2/login endpoint. As a result, the cont parameter is not appended, causing the redirect after login to return to the home page instead of the originally requested page.

Solution/Workaround

By default, the Mendix login page does not start the OIDC flow automatically. The login page can be configured to redirect directly to the identity provider or allow a choice between local authentication and OIDC SSO. To preserve the original deep link and restore the requested page after OIDC login, update the redirect logic within the <script> tag in login.html.

There are three options depending on the implementation.

• Automatic Redirection

Use this option when all authentication requests should be redirected directly to the OIDC Identity Provider.

The default login.html should be replaced with the content of login-automatic.txt file.

Example:

Replace the redirect logic inside the <script> tag in login.html,
Original:

window.location.href = "/index.html";

Target:

window.onload = function () {
    const cont = window.location.search + window.location.hash;
    const base = window.location.pathname.replace(/\/login\.html$/, '');
    const loginUrl = base + '/oauth/v2/login';

    window.location.href = cont
        ? loginUrl + '?cont=' + encodeURIComponent(cont)
        : loginUrl;
};

• Manual Redirection

Use this option when a choice between local authentication and OIDC SSO should be presented during the sign-in process.

The default login.html should be replaced with the content of  login-manual.txt file.

• Using Page and Microflow URLs with OIDC SSO

Page URLs and Microflow URLs are supported with OIDC SSO in Mendix 10.6 and above. Multiple IdPs are supported, and starting from Studio Pro 10.9.0, primitive microflow parameters can be configured as query string parameters. To do this, follow the steps below:

1. Authentication is initiated through the OIDC login page using either automatic or manual redirection.

2. After successful authentication, the originally requested page or microflow is opened through the configured Page URL or Microflow URL.

Additional information

• Mendix documentation:
  • OIDC SSO (Deep Links)
  • Deep Link (LoginLocation)