Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

<@U010WDL0AP7> Did you ever solve this? We are experiencing a similar issue, or so I believe (see <https://ory-community.slack.com/archives/C012RJ2MQ1H/p1686647844811929>)

cc <@U03RYLS2TL7>

No, I didn't solve the issue, which seems to be the same as yours. I've been recently diving into the code and I think I fixed it, but I don't know if it's a legit bug or I'm not using/handling the flow properly.

I found that when an OIDC login flow returns to its callback URL after the first login (i.e. OIDC registration), it starts a new registration flow WITHOUT the `login_challenge` that was used before the OIDC login flow, even when it can be easily recovered and added. Adding 6-7 lines of code seems to solve the issues, but as I say, I don't know if I was doing something wrong. I'll try to add these changes to a PR this week and see if they make sense or not.

I just created an issue <https://github.com/ory/kratos/issues/3321|here>.