Various OIDC issues

[JulianFP]

I have seen some OIDC bugs on the deployed URZ instance. These require some investigation. Behavior I have seen:

• Login through Universitätsklinik Heidelberg (they use Microsoft as an identity provider) failed according to one user report. Unclear if bug in Project-W or in URZ setup or on the Universitätsklinik side. EDIT: Doesn't seem to be an issue anymore, see below
• First login attempt always fails when logging in with a KIT account. Second attempt then succeeds. This was a generic authlib error message inside Project-W, so probably a bug that requires investigation.
• There have been some errors in communicating with the IdP while running the background job. Maybe something to do with the userinfo endpoint of the universities OIDC server? Requires investigation

[alexander-haller]

Login through Universitätsklinik Heidelberg (they use Microsoft as an identity provider) failed according to one user report. Unclear if bug in Project-W or in URZ setup or on the Universitätsklinik side.

Fails always?

First login attempt always fails when logging in with a KIT account. Second attempt then succeeds. This was a generic authlib error message inside Project-W, so probably a bug that requires investigation.

Something "invalid state" maybe?

In general exact error and timestamp+Client IP can help us on the IDP/regapp side.

[alexander-haller]

Login through Universitätsklinik Heidelberg (they use Microsoft as an identity provider) failed according to one user report. Unclear if bug in Project-W or in URZ setup or on the Universitätsklinik side.

FYI: I just tested this with my test Universitätsklinik account and was able to login

[JulianFP]

FYI: I just tested this with my test Universitätsklinik account and was able to login

ok great. It was just one user report and it was from some time ago, so either it fixed itself or it was an issue with that users account or something like that

In general exact error and timestamp+Client IP can help us on the IDP/regapp side.

Yeah in general I need to work on an improved logging system to be able to do some debugging of these kinds of bugs in production. It would, for example, also greatly help to see the Project-W <-> identity provider interactions in detail while this bug occurs. This is why I postponed investigating these until #110 is implemented