fix: prevent silent errors during SSO (account settings) by Gi-ron · Pull Request #38673 · openedx/openedx-platform

Gi-ron · 2026-05-28T20:32:22Z

Description

When a user tries to link a third-party identity (SAML, OAuth2, LTI) that is already linked to a different Open edX account, the backend raises AuthAlreadyAssociated. SocialAuthExceptionMiddleware records this as a Django message and redirects to /account/settings.

That URL was a plain RedirectView that forwards straight to ACCOUNT_MICROFRONTEND_URL — it doesn't carry over Django messages or query params. The error is lost, and the user lands on the Account MFE with no explanation.

Fix

Replace the RedirectView at /account/settings with a small view, account_settings_redirect_view, that:

Checks for a duplicate-provider Django message (via the existing pipeline.get_duplicate_provider).
If found, redirects to the Account MFE with ?duplicate_provider=<provider name>, which the MFE already knows how to render as an alert.
If not found, redirects normally — same behavior as before.

Works for any backend (SAML, OAuth2, LTI), since it only depends on the existing message left by python-social-auth's middleware.

Files changed

common/djangoapps/third_party_auth/views.py: added account_settings_redirect_view.
openedx/core/djangoapps/user_api/legacy_urls.py: swapped the RedirectView for the new view.

Screenshots

The user sees a clear error message in the Linked Accounts section.

Testing

Setup

Configure a SAML IdP (e.g. SimpleSAMLphp) as a Third Party Auth provider in Django Admin.
Create two platform accounts: user_a@example.com and user_b@example.com.
Log in as user_a and complete the SAML login flow to link the IdP identity to user_a.
Log out.

Reproduce the error

Log in as user_b.
Navigate to Account MFE → Linked Accounts.
Click Sign in with [provider name] for the same SAML IdP.
Complete authentication on the IdP side using the same identity used in step 3.

openedx-webhooks · 2026-05-28T20:32:28Z

Thanks for the pull request, @Gi-ron!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

mphilbrick211 · 2026-06-01T18:57:09Z

Hi @Gi-ron! It looks like you're contributing on behalf of eduNEXT. In order to have your CLA check turn green, please have your manager reach out to oscm@axim.org to have you added to our existing entity agreement.

Gi-ron · 2026-06-02T18:23:55Z

Hi @Gi-ron! It looks like you're contributing on behalf of eduNEXT. In order to have your CLA check turn green, please have your manager reach out to oscm@axim.org to have you added to our existing entity agreement.

Thank you! I appreciate it.

I've already been enrolled in the CLA, so I'll keep an eye on the PR and wait for the status to update. Thanks again for your comments!

jignaciopm

Could you check why there're some issues with CI/CD?

felipemontoya

I think the underlying error is clear and needs to be fixed, but the current approach requires some refactor.

felipemontoya · 2026-06-11T14:35:00Z

@Gi-ron also, this PR needs at least one test

Gi-ron · 2026-06-19T17:26:24Z

@Gi-ron also, this PR needs at least one test

I added two tests: one for the cases where exceptions are processed in the middleware, and another for the cases where legacy_urls constructs the redirect URL.

Gi-ron · 2026-06-19T17:30:02Z

Hi @igobranco, @felipemontoya @bra-i-am, @jignaciopm

I’ve added some changes to enable rendering error messages in the Account MFE, along with additional tests.

The main idea is to capture as many python-social-auth exceptions as possible. Unfortunately, at the moment the Account MFE only renders a user-facing message for duplicate_provider.

Could you please take a look at the changes and give me your feedback? It would be really helpful. Thanks in advance!

jfavellar90 · 2026-06-19T21:02:36Z

+
+    params = {'tpa_error_code': error_code}
+
+    if error_code == 'duplicate_provider' and backend_name:


Why do we send the params only on this error occurrence? Could we just send the params for any error type? The error should land in the list defined by TPA_ERROR_CODES

openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label May 28, 2026

openedx-webhooks added this to Contributions May 28, 2026

github-project-automation Bot moved this to Needs Triage in Contributions May 28, 2026

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Jun 1, 2026

mphilbrick211 added the needs test run Author's first PR to this repository, awaiting test authorization from Axim label Jun 1, 2026

mphilbrick211 moved this from Waiting on Author to Needs Tests Run or CLA Signed in Contributions Jun 1, 2026

mphilbrick211 removed the needs test run Author's first PR to this repository, awaiting test authorization from Axim label Jun 5, 2026

jignaciopm reviewed Jun 10, 2026

View reviewed changes

Comment thread common/djangoapps/third_party_auth/views.py Outdated

jignaciopm suggested changes Jun 10, 2026

View reviewed changes

Gi-ron requested a review from jignaciopm June 10, 2026 11:58

Gi-ron changed the title ~~fix: redirect TPA account_settings errors to Account MFE with duplica…~~ fix: prevent silent error during SSO Jun 11, 2026

Gi-ron changed the title ~~fix: prevent silent error during SSO~~ fix: prevent silent errors during SSO Jun 11, 2026

felipemontoya requested changes Jun 11, 2026

View reviewed changes

Comment thread common/djangoapps/third_party_auth/urls.py Outdated

mphilbrick211 added needs test run Author's first PR to this repository, awaiting test authorization from Axim and removed needs test run Author's first PR to this repository, awaiting test authorization from Axim labels Jun 15, 2026

mphilbrick211 moved this from Needs Tests Run or CLA Signed to In Eng Review in Contributions Jun 16, 2026

Gi-ron force-pushed the sgb/render-tpa-account-mfe-error branch 3 times, most recently from 8e90bec to 8ec0a58 Compare June 18, 2026 13:14

feat: update tpa config

a1a4b00

Gi-ron force-pushed the sgb/render-tpa-account-mfe-error branch from 20c06b5 to a1a4b00 Compare June 19, 2026 16:08

fix: silent TPA error messages in MFE account

2afe10a

Gi-ron requested a review from felipemontoya June 19, 2026 17:26

Merge branch 'master' into sgb/render-tpa-account-mfe-error

3cec25b

Gi-ron changed the title ~~fix: prevent silent errors during SSO~~ fix: prevent silent errors during SSO (account settings) Jun 19, 2026

jfavellar90 reviewed Jun 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: prevent silent errors during SSO (account settings)#38673

fix: prevent silent errors during SSO (account settings)#38673
Gi-ron wants to merge 3 commits into
openedx:masterfrom
eduNEXT:sgb/render-tpa-account-mfe-error

Gi-ron commented May 28, 2026 •

edited

Loading

Uh oh!

openedx-webhooks commented May 28, 2026 •

edited

Loading

Uh oh!

mphilbrick211 commented Jun 1, 2026

Uh oh!

Gi-ron commented Jun 2, 2026

Uh oh!

Uh oh!

jignaciopm left a comment

Uh oh!

felipemontoya left a comment

Uh oh!

Uh oh!

felipemontoya commented Jun 11, 2026

Uh oh!

Gi-ron commented Jun 19, 2026

Uh oh!

Gi-ron commented Jun 19, 2026 •

edited

Loading

Uh oh!

jfavellar90 Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants


		params = {'tpa_error_code': error_code}

		if error_code == 'duplicate_provider' and backend_name:

Conversation

Gi-ron commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Fix

Files changed

Screenshots

Testing

Setup

Reproduce the error

Uh oh!

openedx-webhooks commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mphilbrick211 commented Jun 1, 2026

Uh oh!

Gi-ron commented Jun 2, 2026

Uh oh!

Uh oh!

jignaciopm left a comment

Choose a reason for hiding this comment

Uh oh!

felipemontoya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

felipemontoya commented Jun 11, 2026

Uh oh!

Gi-ron commented Jun 19, 2026

Uh oh!

Gi-ron commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jfavellar90 Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Gi-ron commented May 28, 2026 •

edited

Loading

openedx-webhooks commented May 28, 2026 •

edited

Loading

Gi-ron commented Jun 19, 2026 •

edited

Loading