- Issue created by @nbouquet
- Merge request !40fix(session): Use OpenIDConnectSession instead of $_SESSION → (Open) created by nbouquet
The current code is incompatible with custom session handlers (redis sessions for example) because it directly accesses the $_SESSION
super global variable.
cf. https://git.drupalcode.org/project/keycloak/-/blob/2.2.x/src/Controller/KeycloakController.php?ref_type=heads#L124
/**
* Login the user using the Keycloak openid_connect client.
*/
public function login() {
$this->session->saveDestination();
$client_name = 'keycloak';
$configuration = $this->config('openid_connect.settings.keycloak')->get('settings');
$client = $this->pluginManager->createInstance(
$client_name,
$configuration
);
$scopes = $this->claims->getScopes();
$_SESSION['openid_connect_op'] = 'login';
return $client->authorize($scopes);
}
1. Use a custom session manager service
2. Try to authenticate using Keycloak, it will fail silently.
Use the right service (already injected), from OpenID module :
- $_SESSION['openid_connect_op'] = 'login';
+ $this->session->saveOp('login');
Patch tested on Drupal 10.2.3, PHP 8.1, 8.2