SSO Issue's with Redirects

This appears to be related to this bug:

Unless the SSO implementation is a secondary login method (Facebook, Google, etc), it is recommended to implement an IExternalAuthenticationPlugin (v2) Plugin Type  (for 12.0) or IAuthenticationPlugin (v3) Plugin Type  (for 12.1)

Does this issue occur out of nowhere? Our community login was working fine for months; and then this week we have just been experiencing issue after issue.

Since there is a known issue in IOauthClient, will there be a fix deployed for this?

Stephen Vicino said:

Does this issue occur out of nowhere?

This issue would occur only when multiple users are authenticating at the same time. So it would not appear in sites with low authentication rates.

If my co-workers and I try login in at the same time we get redirected to the same random URL. However our issue is also occurring whenever a user logs in with some space between the last login.

Then some attention may need to be made to the implementation details of the IOAuthClient plugin as it may be leaking state as well. 

The recommendation for SSO is to (1) not use IOAuthClient (which is intended for alternate authentication, not primary) and (2) instead use one of the plugin types mentioned above.

A fix to the issue that is known in Community (noted above, TE-15650) would require a new version of IOAuthClient which would require follow-on work for any implementations. It would be more direct to use the recommended plugin type if it is applicable (primary SSO authentication).

Then some attention may need to be made to the implementation details of the IOAuthClient plugin as it may be leaking state as well. 

The recommendation for SSO is to (1) not use IOAuthClient (which is intended for alternate authentication, not primary) and (2) instead use one of the plugin types mentioned above.

A fix to the issue that is known in Community (noted above, TE-15650) would require a new version of IOAuthClient which would require follow-on work for any implementations. It would be more direct to use the recommended plugin type if it is applicable (primary SSO authentication).