Recaptcha and Microsoft Entra ID don't mix

[SzymonSel]

I've got a weird issue. One of our sites uses both external Login (MS Entra ID) and regular login reinforced with ReCaptcha. After some recent bump in OC Libraries version (after build 18407) for whatever reason, recaptcha interferes with MS Entra ID. The logs say Found user using external provider and provider key. but then redirects to /Login with an Invalid login attempt message.

Disabling ReCaptcha makes External SignIn working again.

[github-actions]

We triaged this issue and set the milestone according to the priority we think is appropriate (see the docs on how we triage and prioritize issues).

This indicates when the core team may start working on it. However, if you'd like to contribute, we'd warmly welcome you to do that anytime. See our guide on contributions here.

[sebastienros]

@MikeAlhayek I hope you can understand what's happening

[MikeAlhayek]

@SzymonSel can you confirm that it works if you don't use reCaptcha?

It's possible that because we render the reCaptch in the form but not validate it if the user use external login "since they skip the form".

[SzymonSel]

Yes @MikeAlhayek, precisly so! I don't know why, but there are some random situation, when it passes with ReCaptcha on :|

Maybe it's when first I do a standard login with login, then logout and try External Login. - But this doesn't help as a solution :)

[MikeAlhayek]

I'll try to reproduce the issue when time permits and see what is causing it.