Linking to M365 account not working in the latest Moodle version

[anieminen]

Trying to connect your Moodle account to a Microsoft 365 account using the link in block_microsoft throws an error:
"There was a problem logging you in. Please contact your administrator for assistance."
It has been working until the latest Moodle upgrade. Users use other authentication methods than Entra ID for logging in to Moodle, so OIDC authentication is not enabled currently.

I think this is related to Moodle session cookie changes made in MDL-83526. I tried changing the 'response_mode' to 'query' instead of 'form_post' in /auth/oidc/classes/oidcclient.php, and the M365 account linking seems to work after that.
This way the OAuth callback will arrive as a top-level GET instead of a cross-site POST request, so the "SameSite=Lax" session cookie survives the redirect back to /auth/oidc/index.php.

So that looks like an easy fix, but is it OK to change the response mode?

• Moodle version: 4.5.12
• block_microsoft version: 4.5.7 (2024100735)
• auth_oidc version: 4.5.7 (2024100735)

[weilai-irl]

Hi Arto Nieminen (@anieminen)

Thank you for reporting the issue. I acknowledge the issue, and I confirm this is indeed caused by MDL-83526. We will provide a solution to this issue in the next release.

The solution proposed in your note would work, but there's a small issue - auth code would briefly appears in the URL (history/logs/referer) instead of a POST body. This is generally safe because the auth code is single use. A more proper solution would be to stop relying on the session cookie to identify the linking user, but rather store userid in the auth_oidc_state DB row. I'll try to implement this approach.

Regards,
Lai