Hey Everyone, I have an issue with my self-hosted kratos OIDC login: Setup: kratos: kratos.staging.example.com nextjs app: app.staging.example.com I have configured Microsoft as an open id login option. When using Microsoft to login the first time, everything works fine. After logging out and logging in again, I get the following error:

key ory_kratos_oidc_auth_code_session does not exist in cookie

The issue seems to have to do with the

ory_kratos_continuity

cookie. This cookie has been set twice, once on kratos.staging.example.com and once on example.com. When I clear the

ory_kratos_continuity

cookie on kratos.staging.example.com everything works fine again. This makes this login type unusable at the moment. I noticed that the issue can be solved by checking which ory_kratos_continuity cookie is valid, and using that one. This is because, when Chrome sends the cookies, it sends them in the order of first kratos.staging.example.com and then example.com. When trying the same login flow in Firefox, everything works fine because Firefox sends first the example.com cookie and then the kratos.staging.example.com cookie. Also, when I copy the failed chrome request, switch the cookies order like mentioned, and send it with postman or curl, the same request now works as well. Not sure how to go about this but this seems like a bug to me? Or is this something that can be solved with a correct configuration? (fyi @User)

Hello Lucas, are you able to share you kratos config - sensitive values redacted?

@User Absolutely:

version: v0.8.2-alpha.1

serve:
  public:
    base_url: <https://kratos.staging.example.com/>
    cors:
      enabled: true


  admin:
    base_url: <http://localhost:4434/>

selfservice:
  default_browser_return_url: <https://app.staging.example.com/>
  whitelisted_return_urls:
    - <http://localhost:3000/>
    - <https://app.staging.example.com/>

  methods:
    password:
      enabled: true
    oidc:
      enabled: true
      config:
        providers:
          - id: microsoft # this is `<provider-id>` in the Authorization callback URL. DO NOT CHANGE IT ONCE SET!
            provider: microsoft
            client_id: REDACTED # Replace this with the Application ID from the App Registration
            client_secret: REDACTED # Replace this with the generated Secret value from the App Registration
            tenant: REDACTED # Replace this with the Tenant of your choice (see below)
            mapper_url: file:///etc/config/oidc.microsoft.jsonnet
            scope:
              - profile
              - email

  flows:
    error:
      ui_url: <https://app.staging.example.com/error>

    settings:
      ui_url: <https://app.staging.example.com/settings>
      privileged_session_max_age: 15m

    recovery:
      enabled: true
      ui_url: <https://app.staging.example.com/recovery>

    verification:
      enabled: true
      ui_url: <https://app.staging.example.com/verification>
      after:
        default_browser_return_url: <https://app.staging.example.com/>

    logout:
      after:
        default_browser_return_url: <https://app.staging.example.com/login>

    login:
      ui_url: <https://app.staging.example.com/login>
      lifespan: 10m

    registration:
      lifespan: 10m
      ui_url: <https://app.staging.example.com/registration>
      after:
        password:
          hooks:
            - hook: session

log:
  level: debug
  format: text
  leak_sensitive_values: true

secrets:
  cookie:
    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
  cipher:
    - 32-LONG-SECRET-NOT-SECURE-AT-ALL

ciphers:
  algorithm: xchacha20-poly1305

hashers:
  algorithm: bcrypt
  bcrypt:
    cost: 8

identity:
  default_schema_url: file:///etc/config/identity.default.schema.json

courier:
  smtp:
    connection_uri: REDACTED

cookies:
  same_site: Lax
  domain: .<http://example.com|example.com>

that is the PR that fixed it that is correct https://github.com/ory/kratos/pull/2123 We recently made a big overhaul of the release pipeline, so thats why some releases have been delayed. It should come soon, I cant give you concrete timelines, but bear with us 🙏

Thanks @User ! Yes I noticed the kratos changes as well, upgrading to the master version brought some config changes with it 🙂 I really appreciate the work all the wonderful people at Ory are doing!

That is great to hear Lucas, and feedback like yours is immensely valuable for Ory, so thank you 🙂