{"record":{"id":"c7caaf5e99f9006a","repo":"theonedev/onedev","slug":"unsolicited-oidc-authentication-response","errorCode":null,"errorMessage":"Unsolicited OIDC authentication response","messagePattern":"Unsolicited OIDC authentication response","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/web/page/security/SsoProcessPage.java","lineNumber":241,"sourceCode":"\t\tvar groupNames = authenticated.getGroupNames();\n\t\tif (forNewUser && groupNames == null) \n\t\t\tgroupNames = new HashSet<String>();\n\t\tif (groupNames != null) {\n\t\t\tif (getProvider().getDefaultGroup() != null)\n\t\t\t\tgroupNames.add(getProvider().getDefaultGroup().getName());\n\t\t\tif (settingService.getSecuritySetting().getDefaultGroupName() != null)\n\t\t\t\tgroupNames.add(settingService.getSecuritySetting().getDefaultGroupName());\n\t\t\tmembershipService.syncMemberships(user, groupNames);\n\t\t}\n\t\t\n\t\tif (authenticated.getSshKeys() != null)\n\t\t\tsshKeyService.syncSshKeys(user, authenticated.getSshKeys());\t\t\t\t\t\t\t\t\t\n\t}\n\n\tprivate void afterLogin(User user) {\t\t\n\t\tString redirectUrlAfterLogin = (String) getSession().getAttribute(SESSION_ATTR_REDIRECT_URL);\n\t\tif (StringUtils.isBlank(redirectUrlAfterLogin))\n\t\t\tthrow new AuthenticationException(_T(\"Unsolicited OIDC authentication response\"));\n\n\t\tSecurityUtils.getSubject().runAs(user.getPrincipals());\n\t\tWebSession.get().setSsoLogoutUrl(\n\t\t\t\tgetProvider().getConnector().buildLogoutUrl(getProvider().getName()));\n\n\t\tthrow new RedirectToUrlException(redirectUrlAfterLogin);\t\n\t}\n\n\tprivate SsoProvider getProvider() {\n\t\treturn providerModel.getObject();\n\t}\n\n\t@Override\n\tprotected void onInitialize() {\n\t\tsuper.onInitialize();\n\n\t\tList<Tab> tabs = new ArrayList<>();\n\t\t\t\t\t","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/security/SsoProcessPage.java#L223-L259","documentation":"After a successful SSO login, SsoProcessPage.afterLogin redirects to the URL stored in the session under SESSION_ATTR_REDIRECT_URL, which the login flow sets when it initiates SSO. If that attribute is missing/blank when the OIDC response arrives, the page assumes the response was not solicited by this server and throws this AuthenticationException.","triggerScenarios":"OIDC provider posts the authentication response to the callback URL while no OneDev session attribute 'redirectUrlAfterLogin' exists — e.g. session expired between request start and callback, callback URL was hit directly (bookmarked/health-check), or the response is replayed/duplicated.","commonSituations":"User sat on the IdP login page long enough for the OneDev session to expire; reverse proxy/load balancer session stickiness issues losing the Wicket session; a monitoring probe or crawler hitting the callback URL; user re-submitting the OIDC response via browser refresh.","solutions":["Restart the SSO login from OneDev (click the login link again) so a fresh session and redirect URL are established.","Ensure the callback URL is only reached via the IdP redirect initiated from OneDev; remove bookmarks/probes to the callback endpoint.","Fix session persistence on the server (sticky sessions / shared session store) if sessions are being lost behind a proxy.","Increase OneDev session timeout or reduce IdP login-page dwell time."],"exampleFix":"// before: bookmarked direct access to callback\nGET https://onedev/~sso/process?code=...\n\n// after: always start from OneDev\nGET https://onedev/  -> click 'Sign in with SSO'","handlingStrategy":"retry","validationCode":"// Client-side: only call the callback via the IdP redirect; check session cookie exists\nif (!cookies.contains(\"onedev-session\")) restartLoginFromOneDev();","typeGuard":null,"tryCatchPattern":"try {\n    ssoLogin();\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"Unsolicited\")) {\n        // session lost: restart the SSO flow from scratch\n        restartLoginFromOneDev();\n    } else throw e;\n}","preventionTips":["Always initiate SSO from the OneDev login page; never bookmark the callback URL.","Avoid long idle times on the IdP login page; complete login promptly.","Configure sticky sessions or a shared session store behind load balancers."],"tags":["oidc","sso","session","csrf"],"backgroundTag":"unsolicited-authentication-response","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}