From defa7b5d0ef6b6c68e7093ec72961b45a6a54e9f Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Tue, 10 Mar 2026 13:26:42 +0100
Subject: [PATCH] fix(login): update LDAP flow (#11788)

Closes #11096

# Which Problems Are Solved

This pull request resolves a 404 error that occurred at the end of the
LDAP login flow.

Previously, when a user submitted their LDAP credentials in the
apps/login application, the form initiated the session creation process
but incorrectly redirected the user to /idp/ldap/success, a route that
does not exist. In addition, the redirect failed to preserve necessary
IDP context parameters (such as requestId, organization, and linking
fingerprint info) that are required to fully complete the authentication
intent.

# How the Problems Are Solved

- Fixed redirect path: Updated `createNewSessionForLDAP` to redirect to
`/idp/ldap/process` instead of success, aligning it with the standard
IDP intent processing pipeline which dynamically resolves
`[provider]/process`.
- Preserved context parameters: Extracted `requestId`, `organization`,
`postErrorRedirectUrl`, `linkToSessionId`, and `linkFingerprint` from
the URL parameters on the LDAP page and passed them through
LDAPUsernamePasswordForm down to the server action so the ongoing auth
request is successfully tied to the user's intent.
---
 apps/login/src/app/(login)/idp/ldap/page.tsx  | 20 +++++++++++++++++--
 .../ldap-username-password-form.tsx           | 20 ++++++++++++++++++-
 apps/login/src/lib/server/idp.ts              | 12 ++++++++++-
 3 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/apps/login/src/app/(login)/idp/ldap/page.tsx b/apps/login/src/app/(login)/idp/ldap/page.tsx
index 2e69b313d..5546e98e6 100644
--- a/apps/login/src/app/(login)/idp/ldap/page.tsx
+++ b/apps/login/src/app/(login)/idp/ldap/page.tsx
@@ -11,7 +11,15 @@ export default async function Page(props: {
   params: Promise<{ provider: string }>;
 }) {
   const searchParams = await props.searchParams;
-  const { idpId, organization, link } = searchParams;
+  const {
+    idpId,
+    organization,
+    link,
+    requestId,
+    postErrorRedirectUrl,
+    linkToSessionId,
+    linkFingerprint,
+  } = searchParams;
 
   if (!idpId) {
     throw new Error("No idpId provided in searchParams");
@@ -44,7 +52,15 @@ export default async function Page(props: {
       </div>
 
       <div className="w-full">
-        <LDAPUsernamePasswordForm idpId={idpId} link={link === "true"}></LDAPUsernamePasswordForm>
+        <LDAPUsernamePasswordForm
+          idpId={idpId}
+          link={link === "true"}
+          requestId={requestId}
+          organization={organization}
+          postErrorRedirectUrl={postErrorRedirectUrl}
+          linkToSessionId={linkToSessionId}
+          linkFingerprint={linkFingerprint}
+        />
       </div>
     </DynamicTheme>
   );
diff --git a/apps/login/src/components/ldap-username-password-form.tsx b/apps/login/src/components/ldap-username-password-form.tsx
index f6f75f58a..56b66effa 100644
--- a/apps/login/src/components/ldap-username-password-form.tsx
+++ b/apps/login/src/components/ldap-username-password-form.tsx
@@ -20,9 +20,22 @@ type Inputs = {
 type Props = {
   idpId: string;
   link: boolean;
+  requestId?: string;
+  organization?: string;
+  postErrorRedirectUrl?: string;
+  linkToSessionId?: string;
+  linkFingerprint?: string;
 };
 
-export function LDAPUsernamePasswordForm({ idpId, link }: Props) {
+export function LDAPUsernamePasswordForm({
+  idpId,
+  link,
+  requestId,
+  organization,
+  postErrorRedirectUrl,
+  linkToSessionId,
+  linkFingerprint,
+}: Props) {
   const { register, handleSubmit, formState } = useForm<Inputs>({
     mode: "onChange",
   });
@@ -44,6 +57,11 @@ export function LDAPUsernamePasswordForm({ idpId, link }: Props) {
       username: values.loginName,
       password: values.password,
       link: link,
+      requestId,
+      organization,
+      postErrorRedirectUrl,
+      linkToSessionId,
+      linkFingerprint,
     })
       .catch(() => {
         setError("Could not start LDAP flow");
diff --git a/apps/login/src/lib/server/idp.ts b/apps/login/src/lib/server/idp.ts
index 5864dc241..b2ec4c36a 100644
--- a/apps/login/src/lib/server/idp.ts
+++ b/apps/login/src/lib/server/idp.ts
@@ -216,6 +216,11 @@ type createNewSessionForLDAPCommand = {
   password: string;
   idpId: string;
   link: boolean;
+  requestId?: string;
+  organization?: string;
+  postErrorRedirectUrl?: string;
+  linkToSessionId?: string;
+  linkFingerprint?: string;
 };
 
 export async function createNewSessionForLDAP(command: createNewSessionForLDAPCommand) {
@@ -249,8 +254,13 @@ export async function createNewSessionForLDAP(command: createNewSessionForLDAPCo
   if (command.link) {
     params.set("link", "true");
   }
+  if (command.requestId) params.set("requestId", command.requestId);
+  if (command.organization) params.set("organization", command.organization);
+  if (command.postErrorRedirectUrl) params.set("postErrorRedirectUrl", command.postErrorRedirectUrl);
+  if (command.linkToSessionId) params.set("linkToSessionId", command.linkToSessionId);
+  if (command.linkFingerprint) params.set("linkFingerprint", command.linkFingerprint);
 
   return {
-    redirect: `/idp/ldap/success?` + params.toString(),
+    redirect: `/idp/ldap/process?` + params.toString(),
   };
 }