We are implementing Reverse SSO where FusionAuth acts as the IdP, and we are experiencing an issue with the state parameter when completing authentication with an external OIDC-compliant service (ChainPoint).

Flow Overview:

1. MemberSuite initiates the login request using Reverse SSO.
2. Our SSO Bridge intercepts the request and constructs the authentication URL for FusionAuth, ensuring the state parameter is included.
3. The user is redirected to FusionAuth for authentication.
4. Upon successful authentication, FusionAuth redirects the user to ChainPoint.
5. ChainPoint expects the state parameter for security validation, but it appears to be missing or not returned correctly.

Authentication URL We Construct:

We generate the following authentication URL from our SSO Bridge:

https://auth.example.com/oauth2/authorize?client_id=12345678-1234-1234-1234-123456789abc&response_type=code&response_mode=form_post&redirect_uri=https%3A%2F%2Fchainpoint.example.com%2Flogin%2Fsso%2Fresponse%2F98765432&state=randomgeneratedstate12345

The Problem:

• We generate the state in our SSO Bridge when constructing the authentication URL.
• However, when FusionAuth completes authentication and redirects to ChainPoint, the state is not present or correctly returned.
• Since ChainPoint uses the state for CSRF protection and session validation, the authentication fails.
• We cannot persist the state in our SSO Bridge because, once redirected to FusionAuth, the SSO Bridge is no longer part of the process.
• Since FusionAuth is the entity communicating with ChainPoint, we need a way to retain and correctly propagate the state throughout the flow.
• We cannot modify ChainPoint’s code, nor can we set SameSite=None cookies or manage cross-domain session storage manually.

Questions & Help Needed:

1. How can we ensure that FusionAuth retains and correctly returns the state parameter when redirecting to ChainPoint?
2. Is there a built-in mechanism in FusionAuth to store and return state automatically, or do we need to handle it manually?
3. Would a Lambda function help ensure that the state is included in the final redirect?

Any insights or recommendations from the community would be greatly appreciated! I really appreciate any help you can provide.

Best regards,
Cristian Acevedo
Smarterix