Multisite & redirect url question

[janhenckens]

Question

We're running into an issue with Social Login & a multi-domain multisite project - and I was wondering what & where might be happening here.

Here's the setup we have:

Primary site: project.com
Landing page for Belgium: project.be
Site for Belgium (Dutch): project.be/be
Site for Belgium (French): project.be/fr
Site for France: project.fr
Site for the Netherlands: project.nl

For any of those site, when we visit /admin and click the SSO button (Azure in our case), the callback url comes back as project.com (which is the primary site) - instead of any of the ones we started the request from.

I found the issue that added multisite support to Social Login (#9) and check that code, currentSite simply always returns the primary site.

Also created an issue for this in the craftcms/cms repo: #15971, since I'm not sure where the issue is.

Additional context

Craft 4.12.6.1, Social Login 1.0.20

[engram-design]

So control-panel access, you shouldn't be accessing it from multiple domains anyway, according to the Craft license. As such, it assumes that the primary site is the one you have "licensed" to run Craft from, and redirects to that.

For front-end requests, it should handle redirecting back to the site you came from.

I'll see what I can do about this, but just wanted to flag that first.

[janhenckens]

Hey @engram-design, this question came up again (for the same client).
We now have this structure

brand.com
brand.be/nl
brand.be/fr
brand.fr
brand.nl

But next year we're adding their second brand to the same install, which will add:

second-brand.be/nl
second-brand.be/fr

Forcing a redirect to the primary site (which is brand.com) was fine when we we're only working for that brand, but now we'd have to force the users from the second brand to login on a site that isn't theirs and that feel find a strange...

Not sure how the licensing part holds up as these 7 sites can all validly be linked under that 1 license (Craft's login allows sign-in from each domain, not just the primary).

[engram-design]

Craft's login allows sign-in from each domain, not just the primary

I was just commenting on the CP-based login, which I believe is still correct, you can't log in to second-brand.be/admin and brand.be/admin, for example.

But that's indeed beside the point for front-end logins, which really just needs to redirect the user back to the same site the user was on, after login. But that should be the case now already. You're not seeing that?

[janhenckens]

This is specifically for CP access though - and we definitely have projects that allow CP access from any on the multisite urls. For example:

https://www.gentleest.be/admin/
https://www.leuvenleest.be/admin
https://www.bruggeleest.be/admin
https://www.oostendeleest.be/admin

These are all in the same multisite (on Craft 4 still), but editors have CP access through their city's URL. While maybe not best practice, we haven't had any issues with it for the 4 years these have been running.

[engram-design]

Oh, you can technically do it, and it does work, I think it's more just a licensing thing based on the Single Website Enforcement article I sent through.

To enforce this, Craft does have one technical limitation: you may only access Craft’s control panel from a single public domain per Craft license.

Anyway, that's nothing really to do with what we're talking about here. I'll double check the handling for CP logins, that might be a tad trickier than the front-end, but I think we can figure something out.

[janhenckens]

Anyway, that's nothing really to do with what we're talking about here. I'll double check the handling for CP logins, that might be a tad trickier than the front-end, but I think we can figure something out.

True :) The issue I'm seeing is that the redirect URL passed to the third party is the primary site url, but since that's not what the user is viewing the page just refreshed on the login screen. (they are in fact signed in on the primary domain when going to that url, it's just that they might not know what that url is)

[joelstrom]

We are facing a similar issue but instead with the frontend login on a multi-site. The user is trying to login using Google from domain-b.com but once he returns from the login flow he is simply back in the same page, no error message no success message and not being logged in. domain-a.com is visible in the Redirect URI setting in the plugin's settings for the provider in question, and is not editable by us.

What is the correct procedure to get multi-site login to work on the frontend?

[engram-design]

So they should be being redirected back to their origin. The Redirect URI in the settings is indeed uneditable, mostly because that shouldn't affect things in practice, as that's the callback from OAuth's flow. Once it hits that endpoint, does its thing, it should redirect back to the origin - whatever site that was.

[joelstrom]

Thanks for the quick answer!
The redirect in itself seems to work, we are getting back to the domain-b.com login page after a login attempt, it's just that we are not logged in even if the login flow has successfully gone through! I thought that it might be because of the redirect uri being "wrong" in the admin, but it seems like it's not related to this issue.

1. Sign in with Google
2. Go through Google sign in
3. Return back to the same login page
4. Login status has not changed, user still logged out, no error/success messages (they have been included in the template)

Is there any type of specific setup needed for a multi domain site? Any tips on debugging?
Everything works locally and on our dev/staging environments, but once we take it to production that has this domain-a.com / domain-b.com setup, it stops working.