OIDC and the "Vault login failed. Expired or missing OAuth state" error

Vault
1

We have the vault configured to use our company IdP as the OIDC provider, and normally it all works fine. Recently I’ve stumbled upon this strange error, once in a while the login process using the web UI would fail with the error message “Vault login failed. Expired or missing OAuth state”. There is another topic about this problem here: OIDC error: «Vault login failed. Expired or missing OAuth state» but it seems to be a bit different from ours.

It took some time to figure out how to reproduce it reliably in our case, here are the steps that worked for me:

  1. Navigate to the vault’s web UI and click the login with the OIDC provider. Vault opens a pop-up that navigates to our IdP;
  2. Close the pop-up. Vault shows the error that the pop-up windows was closed which is expected;
  3. Click the login with OIDC button again and this time proceed with the login, after the pop-up closes itself the vault UI shows the “Vault login failed. Expired or missing OAuth state” error.
  4. Clicking the login button once more and doing the login again works as expected, the login process completes and I can enter the vault.

It seems that somewhere around step 2 it does not clean up the failed login process. I checked the network log of the main window, in step 3 the UI first does the post to the vault’s auth_url endpoint that returns the IdP URL with a certain state, then opens the pop-up with that URL and then receives the callback that has the same state, so at least during step 3 the state that is passed around is the same. Moreover, in the IdP logs I can see that the vault has requested and received the user info. There doesn’t seem to be any cleanup call when I close the pop-up in step 2, perhaps that’s what leaves the stale state lingering around so when the next callback comes the vault uses the old state instead of the new one, fails and cleans everything up.

I’m not sure how to report this to the development team, last time I tried to report something directly I was told that since I don’t have the subscription I should use the community forums so I’m reporting it here. Hope it helps someone with a similar problem.