Issues with cross domain SSO

[binaryfire]

Hi all,

Just wondering if I'm doing something wrong or if there are issues with cross domain logins in certain environments? After logging into my primary site (domain1.com) and navigating to domain2.com/somepage, I'm getting a blank page with the following URL:

/admin-ajax.php?action=mercator-sso-login&host=xxx.xxx.xxx&back=https%3A%2F%2Fxxx.xxx.xxx%2F&site=3&nonce=caa098e851&fragment=

And when I navigate to domain2.com/wp-admin, I'm not getting any mercator references in the URL at all. Just the standard login screen at:

/wp-login.php?redirect_to=https%3A%2F%2Fxxx.xxx.xxx%2Fwp-admin%2F&reauth=1

I've tried a bunch of things but can't seem to get it working. sunrise is defined in wp-config.php and judging from the first url, mercator seems to be loading fine. I'm not using the mercator-sso plugin since it now seems to be included in the core mercator repo and I get n "already defined" error when trying to use both.

I'm running php 7.3 and nginx 1.16. Any insights would be great!

Cheers

[mrjarbenne]

I just tried to update and noticed this issue. I'm seeing the same behaviour in 1.0.3, but not in 1.0.0. I'm reverting back to the older version for now.

[shelbybark]

Any updates on this? I'm seeing the same problem with an installation.

[tomjn]

I'm now seeing this after updating mercator

[tomjn]

I was able to bring my site back up for now by disabling SSO with this code:

add_filter( 'mercator.sso.enabled', '__return_false' );

However, putting it in a plugin, theme, or even an mu-plugin was ineffective, I had to add the line to sunrise.php just before mercator was loaded or it was too late.

I've yet to identify the problem causing the issue, but it appears to be a 403 status in sso.php from login_handle_response or login_handle_request

[tomjn]

My current suspicion is aimed at the shared nonce code

[yallahweb]

Hi Tom,
Do you have any update on this? I'm getting a 403 error as well when I'm logged in into WP and trying to reach the myaliasdomain.com. The subdomain is fine (subdomain.maindomain.com)

I'm automatically redirected to this URL: https://mymaindomain.com/wp-admin/admin-ajax.php?action=mercator-sso-login&host=myaliasdomain.com&back=https%3A%2F%2myaliasdomain.com%2F&site=2

[bobwol]

Same issue here.

Thanks @tomjn

I moved the filters before the require mercator.php and it looks like it's working now:

add_filter( 'mercator.sso.enabled', '__return_false' );
add_filter( 'mercator.sso.multinetwork.enabled', '__return_false' );
require WPMU_PLUGIN_DIR . '/mercator/mercator.php';

[biguenique]

/admin-ajax.php?action=mercator-sso-login&host=xxx.xxx.xxx&back=https%3A%2F%2Fxxx.xxx.xxx%2F&site=3&nonce=caa098e851&fragment=

I'm new to Mercator, and I obviously have the same problem. I just want to point out that the ampersands (&) in the query string are encoded into & -- and it is definitely wrong in this context. So maybe this is simply an issue of URL encoding?

This might be pretty hard to compare with a precedent working version since those URLs are never actually visible. I think I'm going to have to dive into the source code to find if any change would have affected the URL encoding... SSO is cool, so it would be nice to find a fix for this.

[splaquet]

I was having these issues, so I tried modifying sunrise as others suggested. Those two SSO mod lines in sunrise were the only thing preventing my network from falling, but something wasn’t right.

Although I was able to get things working, I soon realized that cookies weren’t properly setting.

That’s not something that you’d necessarily notice, but my multisite is based around several dozen woocommerce stores. Stores with mapped domains were showing products added to carts, but empty carts upon viewing/checking out. (Forgive me, but I’m repeating some of this from another ticket)

After futzing around forever, with frustrated teammates and clients... I finally realized (or at least on my end) that some cookie lines added into my wp-config file were the apparent culprits for network failure.

I remarked the cookie lines in wp-config, the sso false lines in sunrise, and everything appeared to be working as expected. (Seems obvious afterwards 😝)

I’ve noticed a few cdn issues, but I’ll most likely be able to work those out in time.

The only pressing issue that seems to still bog things down is the Mercator redirect url, upon page load for a subsite with a mapped domain. As of now, that appears to add an additional 1-2sec of load time.

As the mapped domain is the primary in most cases, can anyone recommend a workaround for better page speed?