Thank you for the hint, we have tracked this ticket in ADI-418 and will publish a fix with 2.0.11.
In the meantime you can try to adapt the loginUser method like this
[code]
protected function loginUser($user, $exit = true)
{
// ADI-418: Accessing un-protected URLs directly with SSO enabled redirect does not work
$redirectTo = (isset($_SERVER['REDIRECT_URL']) && !empty($_SERVER['REDIRECT_URL'])) ? $_SERVER['REDIRECT_URL'] : null;
// default redirect if WordPress forces itself a login, e.g. when accessing /wp-admin
$redirectTo = (!empty($_REQUEST['redirect_to'])) ? $_REQUEST['redirect_to'] : $redirectTo;
// if not set, fall back to the home url
$redirectTo = empty($redirectTo) ? home_url('/') : $redirectTo;
do_action('wp_login', $user->user_login, $user);
wp_set_current_user($user->ID);
[/code]
I’d really appreciate your feedback!
I was able to make the required changes to my plugin and it works like a dream now! Thanks for that!
Thank you for the feedback! Fix has been merged into master.
One more followup. Now when I click the Sign in with SSO link on the WordPress login box, it just simply refreshes the page and does nothing. I reverted my changes back to the default,
[code]
protected function loginUser($user, $exit = true)
{
$redirectTo = (!empty($_REQUEST['redirect_to'])) ? $_REQUEST['redirect_to'] : home_url('/');
do_action('wp_login', $user->user_login, $user);
wp_set_current_user($user->ID);
wp_set_auth_cookie($user->ID);
wp_safe_redirect($redirectTo);
if ($exit) {
exit;
}
}
[/code]
And it works now. But now my redirect is not working again.
Thanks!
Drew