Marco van Wieren

Resolved and closing the ticket.

Hi @janosf

Again, thank you for bringing this to my attention.

Release 42.10 contains the fix (now using phplibsec 3.0.52).

Hope that helps!

Best wishes

-Marco

Hi @zwatkinstamu

I am sorry for my late response, but your issue was fixed with release 42.6. Below is the change log item for it.

FIX Resolved an issue that prevented the plugin from redirecting the user back to the URL they intended to navigate to, before WPO365 initialized SSO and sent the user to Microsoft to authenticate. [LOGIN]

Hope that the original service has been restored – but now in a more reliable and secure way with nonce-verification enabled!

Hi @gabbsmo and @simonmista

For the sake of clarity, I would like the add the following. When you add the following line to your wp-config.php define( ‘WPO_AUTH_SCENARIO’, ‘internet’ ); then the plugin will try and bail out as soon as a request is not for your WP admin. Version 42.4 fixes this, but the combination with “Use client-side redirect” on the plugin’s “Login / logout” configuration page (causing the user to be redirected to Microsoft using a small JavaScript instead of being redirected by the server) has been overlooked. And as a result – if “Use client-side redirect” is enabled, a user is not redirected to Microsoft but instead ends up at https://<your website>/wpo/sso/start?cb=xyz. To fix this, there are actually 2 options:

• Leave “Use client-side redirect” checked, but instead check the option “Use admin URL to initiate authentication” on the plugin’s “Miscellaneous” configuration page. This is the recommended solution when you need client-side redirection, for example because your website is embedded in Teams or an iframe.
• Uncheck the “Use client-side redirect” option on the plugin’s “Login / logout” configuration page.

Hope this helps you and others alike!

-Marco

Thank you @gabbsmo for confirming that it works when you disable the use of the client-side redirect. When you don’t need Teams or iframe support, then you’re anyway better of with it. The plugin’s Self-test would have also highlighted this. I will – however – look into re-enabling support for the combination of defining WPO_AUTH_SCENARIO in a wp-config.php and client-side redirection.

Again, thanks and let me know if anything comes up!

Hi @gabbsmo

Are you using the Teams integration? If you do not use the site in a Microsoft Teams App or Tab (or in an iframe), then please try and uncheck the option “Use client-side redirect” on the plugin’s “Login / logout” configuration page, clear all server caches and test again.

Hope this helps!

• This reply was modified 2 weeks, 1 day ago by Marco van Wieren.

Hi @gabbsmo

I have just now released version 42.4. I reviewed the current detection and realized that are also other scenarios where the detection will fail. I have updated the detection to “must end with”, which should also be able to work-around the URL changed by WPML – for example when it adds /en/.

Thank you again for bringing this to my attention!

-Marco

Hi @simonmista and @gabbsmo

You’re absolutely right. The last update ignored the custom authentication scenario WPO_AUTH_SCENARIO. I have just released version 43.3. This release should resolve this issue.

Thank you for making me aware of this and I am sorry for any inconvenience!

-Marco