MW: 1.41.1
PluggableAuth: 7.1.0 (4111a57)
OpenIDConnect: 8.0.2 (3a3fca9)
jumbojett/openid-connect-php; 1.0.0
Steps to replicate the issue:
- Visit a wiki that restricts read access to logged in users. The wiki should be configured to with automatic login and be set up to use only one authentication method (e.g. OpenIDConnect) to view it.
- Log in and verify your access to the wiki.
- Close the browser with Alt-f x.
- Open the browser.
- Press Ctrl-Shift-T to open the previously closed browser.
- See error: Fatal error authenticating user.
Set $wgRememberMe = "always";
Verify that the above steps do not result in the same error.
Repeat the same steps with this additional one after step 2:
- ... b) Clear your cookies for the site.
Verify that you now see error again.
Before closing Chrome, I verified the URL was not on the Special:PluggableAuthLogin page (where the error occurs). Most recently, it was on Special:Version and I verified that Ctrl-Shift-T brought up Special:Version initially.
The PluggableAuthLogin url contained ?code=XXXX...&iss=XXXX...&state=XXXX...&client_id=XXXX.... Clicking the logo on the sidebar (to visit Main_Page or the equivalent) was successful
Starting chrome with devtools (possible with chrome's --auto-open-devtools-for-tabs cli option) shows that the initial request (may) be missing the session cookie. In fact, visiting the site "normally" after clearing cookies and starting the browser--that is, typing the url into the browser--seems to bring up the site properly, but also populates the session cookie.
Examination of the requests shows that it goes to Special:PluggableAuthLogin without visiting Special:UserLogin where the session cookie is set.
I'm a bit confused about why the first request is to Special:PluggableAuthLogin when restoring the tab. I would think it would be to the url on the page when the browser closed. But, in any case, it looks like a visit to Special:PluggableAuthLogin without a session cookie should result in a visit to Special:UserLogin to get the session cookie (or some other method to generate the session cookie).