Created attachment 873905 [details] accountchooser When you choose some IDP in SP's Domain Chooser it redirect you to that IDP which ask you for authentication. In case that you make wrong authentication or unrealize authentication and hit that SP again it show you domain chooser again (maybe IDP should be chosen according to set cookie - it depends when cookie should be set) and if you choose any of IDPs (same or different) from domain chooser it doesn't redirect you to chosen IDP (according to idpmap.properties) but try to redirect you to IDP defined in <IdentityURL> attribute of picketlink.xml. Steps to reproduce: 1) Start standalone server and add needed security domains via CLI commands: /subsystem=security/security-domain=idp:add(cache-type=default) /subsystem=security/security-domain=idp/authentication=classic:add /subsystem=security/security-domain=idp/authentication=classic/login-module=UsersRoles:add(code=UsersRoles, flag=required, module-options=[("usersProperties"=>"users.properties"), ("rolesProperties"=>"roles.properties")]) /subsystem=security/security-domain=sp:add(cache-type=default) /subsystem=security/security-domain=sp/authentication=classic:add /subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule, flag=required) 2) Deploy accountchooser.war and idp1.war 3) Open browser and hit http://localhost:8080/accountchooser/ and choose DomainA. Try to authenticate with wrong credentials or don't do anything with authentication. Hit http://localhost:8080/accountchooser/ again and choose DomainA again. It try to redirect you to http://localhost:8080/neverShowThis/ instead of chosen IDP.
Created attachment 873906 [details] idp1
Unfortunately verification failed. This fix successfully repairs direct access to chosen link after wrong or unrealized authentication on IDP, but there is still same issue if you hit http://localhost:8080/accountchooser/. Steps to reproduce: 1) hit http://localhost:8080/accountchooser/ and choose DomainA 2) do nothing on redirected IDP 3) hit again http://localhost:8080/accountchooser/ and reload page by pressing F5 (because some browsers use cache) - http://localhost:8080/neverShowThis/ is shown
PR: https://github.com/jbossas/jboss-eap/pull/1378
Verified in EAP 6.3.0.ER7.