@directus/api 32.2.0 → 33.1.0

package/dist/auth/drivers/ldap.js

@@ -1,8 +1,8 @@
 import { useEnv } from '@directus/env';
-import { ErrorCode, InvalidCredentialsError, InvalidPayloadError, InvalidProviderConfigError, InvalidProviderError, ServiceUnavailableError, UnexpectedResponseError, isDirectusError, } from '@directus/errors';
+import { ErrorCode, InvalidCredentialsError, InvalidPayloadError, InvalidProviderConfigError, InvalidProviderError, isDirectusError, ServiceUnavailableError, UnexpectedResponseError, } from '@directus/errors';
 import { Router } from 'express';
 import Joi from 'joi';
-import ldap from 'ldapjs';
+import { Client, InappropriateAuthError, InsufficientAccessError, InvalidCredentialsError as LdapInvalidCredentialsError, } from 'ldapts';
 import { REFRESH_COOKIE_OPTIONS, SESSION_COOKIE_OPTIONS } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
@@ -12,8 +12,8 @@ import { createDefaultAccountability } from '../../permissions/utils/create-defa
 import { AuthenticationService } from '../../services/authentication.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
-import { AuthDriver } from '../auth.js';
 import { getSchema } from '../../utils/get-schema.js';
+import { AuthDriver } from '../auth.js';
 // 0x2: ACCOUNTDISABLE
 // 0x10: LOCKOUT
 // 0x800000: PASSWORD_EXPIRED
@@ -34,127 +34,101 @@ export class LDAPAuthDriver extends AuthDriver {
             throw new InvalidProviderConfigError({ provider });
         }
         const clientConfig = typeof config['client'] === 'object' ? config['client'] : {};
-        this.bindClient = ldap.createClient({ url: clientUrl, reconnect: true, ...clientConfig });
-        this.bindClient.on('error', (err) => {
-            logger.warn(err);
+        this.bindClient = new Client({
+            url: clientUrl,
+            ...clientConfig,
         });
         this.config = config;
     }
     async validateBindClient() {
         const logger = useLogger();
         const { bindDn, bindPassword, provider } = this.config;
-        return new Promise((resolve, reject) => {
-            // Healthcheck bind user
-            this.bindClient.search(bindDn, {}, (err, res) => {
-                if (err) {
-                    reject(handleError(err));
-                    return;
-                }
-                res.on('searchEntry', () => {
-                    resolve();
-                });
-                res.on('error', () => {
-                    // Attempt to rebind on search error
-                    this.bindClient.bind(bindDn, bindPassword, (err) => {
-                        if (err) {
-                            const error = handleError(err);
-                            if (isDirectusError(error, ErrorCode.InvalidCredentials)) {
-                                logger.warn('Invalid bind user');
-                                reject(new InvalidProviderConfigError({ provider }));
-                            }
-                            else {
-                                reject(error);
-                            }
-                        }
-                        else {
-                            resolve();
-                        }
-                    });
-                });
-                res.on('end', (result) => {
-                    // Handle edge case where authenticated bind user cannot read their own DN
-                    // Status `0` is success
-                    if (result?.status !== 0) {
-                        logger.warn('[LDAP] Failed to find bind user record');
-                        reject(new UnexpectedResponseError());
-                    }
-                });
+        try {
+            // Attempt to bind with the configured credentials
+            await this.bindClient.bind(bindDn, bindPassword);
+            // Healthcheck: verify bind user can read their own DN
+            const { searchEntries } = await this.bindClient.search(bindDn, {
+                scope: 'base',
             });
-        });
+            if (searchEntries.length === 0) {
+                logger.warn('[LDAP] Failed to find bind user record');
+                throw new UnexpectedResponseError();
+            }
+        }
+        catch (err) {
+            const error = handleError(err);
+            if (isDirectusError(error, ErrorCode.InvalidCredentials)) {
+                logger.warn('Invalid bind user');
+                throw new InvalidProviderConfigError({ provider });
+            }
+            throw error;
+        }
     }
     async fetchUserInfo(baseDn, filter, scope) {
         let { firstNameAttribute, lastNameAttribute, mailAttribute } = this.config;
         firstNameAttribute ??= 'givenName';
         lastNameAttribute ??= 'sn';
         mailAttribute ??= 'mail';
-        return new Promise((resolve, reject) => {
-            // Search for the user in LDAP by filter
-            this.bindClient.search(baseDn, {
-                filter,
-                scope,
+        try {
+            const searchOptions = {
                 attributes: ['uid', firstNameAttribute, lastNameAttribute, mailAttribute, 'userAccountControl'],
-            }, (err, res) => {
-                if (err) {
-                    reject(handleError(err));
-                    return;
-                }
-                res.on('searchEntry', ({ object }) => {
-                    const user = {
-                        dn: object['dn'],
-                        userAccountControl: Number(getEntryValue(object['userAccountControl']) ?? 0),
-                    };
-                    const firstName = getEntryValue(object[firstNameAttribute]);
-                    if (firstName)
-                        user.firstName = firstName;
-                    const lastName = getEntryValue(object[lastNameAttribute]);
-                    if (lastName)
-                        user.lastName = lastName;
-                    const email = getEntryValue(object[mailAttribute]);
-                    if (email)
-                        user.email = email;
-                    const uid = getEntryValue(object['uid']);
-                    if (uid)
-                        user.uid = uid;
-                    resolve(user);
-                });
-                res.on('error', (err) => {
-                    reject(handleError(err));
-                });
-                res.on('end', () => {
-                    resolve(undefined);
-                });
-            });
-        });
+            };
+            if (filter !== undefined)
+                searchOptions.filter = filter;
+            if (scope !== undefined)
+                searchOptions.scope = scope;
+            const { searchEntries } = await this.bindClient.search(baseDn, searchOptions);
+            if (searchEntries.length === 0) {
+                return undefined;
+            }
+            const entry = searchEntries[0];
+            const user = {
+                dn: entry['dn'],
+                userAccountControl: Number(getEntryValue(entry['userAccountControl']) ?? 0),
+            };
+            const firstName = getEntryValue(entry[firstNameAttribute]);
+            if (firstName)
+                user.firstName = firstName;
+            const lastName = getEntryValue(entry[lastNameAttribute]);
+            if (lastName)
+                user.lastName = lastName;
+            const email = getEntryValue(entry[mailAttribute]);
+            if (email)
+                user.email = email;
+            const uid = getEntryValue(entry['uid']);
+            if (uid)
+                user.uid = uid;
+            return user;
+        }
+        catch (err) {
+            throw handleError(err);
+        }
     }
     async fetchUserGroups(baseDn, filter, scope) {
-        return new Promise((resolve, reject) => {
-            let userGroups = [];
-            // Search for the user info in LDAP by group attribute
-            this.bindClient.search(baseDn, {
-                filter,
-                scope,
+        try {
+            const searchOptions = {
                 attributes: ['cn'],
-            }, (err, res) => {
-                if (err) {
-                    reject(handleError(err));
-                    return;
+            };
+            if (filter !== undefined)
+                searchOptions.filter = filter;
+            if (scope !== undefined)
+                searchOptions.scope = scope;
+            const { searchEntries } = await this.bindClient.search(baseDn, searchOptions);
+            const userGroups = [];
+            for (const entry of searchEntries) {
+                const cn = entry['cn'];
+                if (Array.isArray(cn)) {
+                    userGroups.push(...cn.map((v) => String(v)));
                 }
-                res.on('searchEntry', ({ object }) => {
-                    if (typeof object['cn'] === 'object') {
-                        userGroups = [...userGroups, ...object['cn']];
-                    }
-                    else if (object['cn']) {
-                        userGroups.push(object['cn']);
-                    }
-                });
-                res.on('error', (err) => {
-                    reject(handleError(err));
-                });
-                res.on('end', () => {
-                    resolve(userGroups);
-                });
-            });
-        });
+                else if (cn) {
+                    userGroups.push(String(cn));
+                }
+            }
+            return userGroups;
+        }
+        catch (err) {
+            throw handleError(err);
+        }
     }
     async fetchUserId(userDn) {
         const user = await this.knex
@@ -171,19 +145,15 @@ export class LDAPAuthDriver extends AuthDriver {
         const logger = useLogger();
         await this.validateBindClient();
         const { userDn, userScope, userAttribute, groupDn, groupScope, groupAttribute, defaultRoleId, syncUserInfo } = this.config;
-        const userInfo = await this.fetchUserInfo(userDn, new ldap.EqualityFilter({
-            attribute: userAttribute ?? 'cn',
-            value: payload['identifier'],
-        }), userScope ?? 'one');
+        const userInfo = await this.fetchUserInfo(userDn, `(${validateLDAPAttribute(userAttribute ?? 'cn')}=${escapeFilterValue(payload['identifier'])})`, userScope ?? 'one');
         if (!userInfo?.dn) {
             throw new InvalidCredentialsError();
         }
         let userRole;
         if (groupDn) {
-            const userGroups = await this.fetchUserGroups(groupDn, new ldap.EqualityFilter({
-                attribute: groupAttribute ?? 'member',
-                value: groupAttribute?.toLowerCase() === 'memberuid' && userInfo.uid ? userInfo.uid : userInfo.dn,
-            }), groupScope ?? 'one');
+            const groupAttr = groupAttribute ?? 'member';
+            const memberValue = groupAttr.toLowerCase() === 'memberuid' && userInfo.uid ? userInfo.uid : userInfo.dn;
+            const userGroups = await this.fetchUserGroups(groupDn, `(${validateLDAPAttribute(groupAttr)}=${escapeFilterValue(memberValue)})`, groupScope ?? 'one');
             if (userGroups.length) {
                 userRole = await this.knex
                     .select('id')
@@ -253,51 +223,86 @@ export class LDAPAuthDriver extends AuthDriver {
         if (!user.external_identifier || !password) {
             throw new InvalidCredentialsError();
         }
-        return new Promise((resolve, reject) => {
-            const clientConfig = typeof this.config['client'] === 'object' ? this.config['client'] : {};
-            const client = ldap.createClient({
-                url: this.config['clientUrl'],
-                ...clientConfig,
-                reconnect: false,
-            });
-            client.on('error', (err) => {
-                reject(handleError(err));
-            });
-            client.bind(user.external_identifier, password, (err) => {
-                if (err) {
-                    reject(handleError(err));
-                }
-                else {
-                    resolve();
-                }
-                client.destroy();
-            });
+        const clientConfig = typeof this.config['client'] === 'object' ? this.config['client'] : {};
+        const client = new Client({
+            url: this.config['clientUrl'],
+            ...clientConfig,
         });
+        try {
+            await client.bind(user.external_identifier, password);
+        }
+        catch (err) {
+            throw handleError(err);
+        }
+        finally {
+            await client.unbind().catch(() => {
+                // Ignore unbind errors
+            });
+        }
     }
     async login(user, payload) {
         await this.verify(user, payload['password']);
     }
     async refresh(user) {
         await this.validateBindClient();
-        const userInfo = await this.fetchUserInfo(user.external_identifier);
+        // Use scope 'base' to search the specific DN entry
+        const userInfo = await this.fetchUserInfo(user.external_identifier, undefined, 'base');
         if (userInfo?.userAccountControl && userInfo.userAccountControl & INVALID_ACCOUNT_FLAGS) {
             throw new InvalidCredentialsError();
         }
     }
 }
 const handleError = (e) => {
-    if (e instanceof ldap.InappropriateAuthenticationError ||
-        e instanceof ldap.InvalidCredentialsError ||
-        e instanceof ldap.InsufficientAccessRightsError) {
+    if (e instanceof InappropriateAuthError ||
+        e instanceof LdapInvalidCredentialsError ||
+        e instanceof InsufficientAccessError) {
         return new InvalidCredentialsError();
     }
+    if (e instanceof Error) {
+        return new ServiceUnavailableError({
+            service: 'ldap',
+            reason: `Service returned unexpected error: ${e.message}`,
+        });
+    }
     return new ServiceUnavailableError({
         service: 'ldap',
-        reason: `Service returned unexpected error: ${e.message}`,
+        reason: 'Service returned unexpected error',
     });
 };
 const getEntryValue = (value) => {
-    return typeof value === 'object' ? value[0] : value;
+    if (value === undefined)
+        return undefined;
+    if (Buffer.isBuffer(value)) {
+        return value.toString();
+    }
+    if (Array.isArray(value)) {
+        const first = value[0];
+        if (Buffer.isBuffer(first)) {
+            return first.toString();
+        }
+        return first;
+    }
+    return value;
+};
+/**
+ * Escape special characters in LDAP filter values according to RFC 4515
+ */
+const escapeFilterValue = (value) => {
+    return value
+        .replace(/\\/g, '\\5c')
+        .replace(/\*/g, '\\2a')
+        .replace(/\(/g, '\\28')
+        .replace(/\)/g, '\\29')
+        .replace(/\0/g, '\\00');
+};
+/**
+ * Validate LDAP attribute name according to RFC 4512
+ */
+const validateLDAPAttribute = (name) => {
+    if (/^[a-zA-Z][a-zA-Z0-9-]*$/.test(name) === false) {
+        throw new Error(`Invalid LDAP attribute name: "${name}"`);
+    }
+    return name;
 };
 export function createLDAPAuthRouter(provider) {
     const router = Router();

package/dist/auth/drivers/local.js

@@ -1,9 +1,9 @@
+import { performance } from 'perf_hooks';
 import { useEnv } from '@directus/env';
 import { InvalidCredentialsError, InvalidPayloadError } from '@directus/errors';
 import argon2 from 'argon2';
 import { Router } from 'express';
 import Joi from 'joi';
-import { performance } from 'perf_hooks';
 import { REFRESH_COOKIE_OPTIONS, SESSION_COOKIE_OPTIONS } from '../../constants.js';
 import { respond } from '../../middleware/respond.js';
 import { createDefaultAccountability } from '../../permissions/utils/create-default-accountability.js';

package/dist/auth/drivers/oauth2.d.ts

@@ -5,12 +5,11 @@ import type { RoleMap } from '../../types/rolemap.js';
 import { LocalAuthDriver } from './local.js';
 export declare class OAuth2AuthDriver extends LocalAuthDriver {
     client: Client;
-    redirectUrl: string;
     config: Record<string, any>;
     roleMap: RoleMap;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
     generateCodeVerifier(): string;
-    generateAuthUrl(codeVerifier: string, prompt?: boolean): string;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean, callbackUrl?: string): string;
     private fetchUserId;
     getUserID(payload: Record<string, any>): Promise<string>;
     login(user: User): Promise<void>;

package/dist/auth/drivers/oauth2.js

@@ -16,40 +16,37 @@ import { AuthenticationService } from '../../services/authentication.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
+import { getSchema } from '../../utils/get-schema.js';
 import { getSecret } from '../../utils/get-secret.js';
-import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
 import { verifyJWT } from '../../utils/jwt.js';
 import { Url } from '../../utils/url.js';
+import { generateCallbackUrl } from '../utils/generate-callback-url.js';
+import { isLoginRedirectAllowed } from '../utils/is-login-redirect-allowed.js';
 import { LocalAuthDriver } from './local.js';
-import { getSchema } from '../../utils/get-schema.js';
 export class OAuth2AuthDriver extends LocalAuthDriver {
     client;
-    redirectUrl;
     config;
     roleMap;
     constructor(options, config) {
         super(options, config);
-        const env = useEnv();
         const logger = useLogger();
         const { authorizeUrl, accessUrl, profileUrl, clientId, clientSecret, ...additionalConfig } = config;
         if (!authorizeUrl || !accessUrl || !profileUrl || !clientId || !clientSecret || !additionalConfig['provider']) {
             logger.error('Invalid provider config');
             throw new InvalidProviderConfigError({ provider: additionalConfig['provider'] });
         }
-        const redirectUrl = new Url(env['PUBLIC_URL']).addPath('auth', 'login', additionalConfig['provider'], 'callback');
-        this.redirectUrl = redirectUrl.toString();
         this.config = additionalConfig;
         this.roleMap = {};
         const roleMapping = this.config['roleMapping'];
-        if (roleMapping) {
-            this.roleMap = roleMapping;
-        }
         // role mapping will fail on login if AUTH_<provider>_ROLE_MAPPING is an array instead of an object.
         // This happens if the 'json:' prefix is missing from the variable declaration. To save the user from exhaustive debugging, we'll try to fail early here.
         if (roleMapping instanceof Array) {
             logger.error("[OAuth2] Expected a JSON-Object as role mapping, got an Array instead. Make sure you declare the variable with 'json:' prefix.");
             throw new InvalidProviderError();
         }
+        if (roleMapping) {
+            this.roleMap = roleMapping;
+        }
         const issuer = new Issuer({
             authorization_endpoint: authorizeUrl,
             token_endpoint: accessUrl,
@@ -67,7 +64,6 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
         this.client = new issuer.Client({
             client_id: clientId,
             client_secret: clientSecret,
-            redirect_uris: [this.redirectUrl],
             response_types: ['code'],
             ...clientOptionsOverrides,
         });
@@ -75,7 +71,7 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
     generateCodeVerifier() {
         return generators.codeVerifier();
     }
-    generateAuthUrl(codeVerifier, prompt = false) {
+    generateAuthUrl(codeVerifier, prompt = false, callbackUrl) {
         const { plainCodeChallenge } = this.config;
         try {
             const codeChallenge = plainCodeChallenge ? codeVerifier : generators.codeChallenge(codeVerifier);
@@ -89,6 +85,7 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
                 code_challenge_method: plainCodeChallenge ? 'plain' : 'S256',
                 // Some providers require state even with PKCE
                 state: codeChallenge,
+                redirect_uri: callbackUrl,
             });
         }
         catch (e) {
@@ -116,7 +113,7 @@ export class OAuth2AuthDriver extends LocalAuthDriver {
             const codeChallenge = plainCodeChallenge
                 ? payload['codeVerifier']
                 : generators.codeChallenge(payload['codeVerifier']);
-            tokenSet = await this.client.oauthCallback(this.redirectUrl, { code: payload['code'], state: payload['state'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge });
+            tokenSet = await this.client.oauthCallback(payload['callbackUrl'], { code: payload['code'], state: payload['state'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge });
             userInfo = await this.client.userinfo(tokenSet.access_token);
         }
         catch (e) {
@@ -275,12 +272,19 @@ export function createOAuth2AuthRouter(providerName) {
         const provider = getAuthProvider(providerName);
         const codeVerifier = provider.generateCodeVerifier();
         const prompt = !!req.query['prompt'];
-        const redirect = req.query['redirect'];
         const otp = req.query['otp'];
-        if (isLoginRedirectAllowed(redirect, providerName) === false) {
+        const redirect = req.query['redirect'];
+        if (!isLoginRedirectAllowed(providerName, redirect)) {
             throw new InvalidPayloadError({ reason: `URL "${redirect}" can't be used to redirect after login` });
         }
-        const token = jwt.sign({ verifier: codeVerifier, redirect, prompt, otp }, getSecret(), {
+        const callbackUrl = generateCallbackUrl(providerName, `${req.protocol}://${req.get('host')}`);
+        const token = jwt.sign({
+            verifier: codeVerifier,
+            redirect,
+            prompt,
+            otp,
+            callbackUrl,
+        }, getSecret(), {
             expiresIn: '5m',
             issuer: 'directus',
         });
@@ -288,7 +292,7 @@ export function createOAuth2AuthRouter(providerName) {
             httpOnly: true,
             sameSite: 'lax',
         });
-        return res.redirect(provider.generateAuthUrl(codeVerifier, prompt));
+        return res.redirect(provider.generateAuthUrl(codeVerifier, prompt, callbackUrl));
     }, respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
@@ -303,7 +307,7 @@ export function createOAuth2AuthRouter(providerName) {
             logger.warn(e, `[OAuth2] Couldn't verify OAuth2 cookie`);
             throw new InvalidCredentialsError();
         }
-        const { verifier, prompt, otp } = tokenData;
+        const { verifier, prompt, otp, callbackUrl } = tokenData;
         let { redirect } = tokenData;
         const accountability = createDefaultAccountability({
             ip: getIPFromReq(req),
@@ -326,6 +330,7 @@ export function createOAuth2AuthRouter(providerName) {
                 code: req.query['code'],
                 codeVerifier: verifier,
                 state: req.query['state'],
+                callbackUrl,
             }, { session: authMode === 'session', ...(otp ? { otp: String(otp) } : {}) });
         }
         catch (error) {

package/dist/auth/drivers/openid.d.ts

@@ -5,13 +5,12 @@ import type { RoleMap } from '../../types/rolemap.js';
 import { LocalAuthDriver } from './local.js';
 export declare class OpenIDAuthDriver extends LocalAuthDriver {
     client: null | Client;
-    redirectUrl: string;
     config: Record<string, any>;
     roleMap: RoleMap;
     constructor(options: AuthDriverOptions, config: Record<string, any>);
     private getClient;
     generateCodeVerifier(): string;
-    generateAuthUrl(codeVerifier: string, prompt?: boolean): Promise<string>;
+    generateAuthUrl(codeVerifier: string, prompt?: boolean, callbackUrl?: string): Promise<string>;
     private fetchUserId;
     getUserID(payload: Record<string, any>): Promise<string>;
     login(user: User): Promise<void>;

package/dist/auth/drivers/openid.js

@@ -16,20 +16,19 @@ import { AuthenticationService } from '../../services/authentication.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
+import { getSchema } from '../../utils/get-schema.js';
 import { getSecret } from '../../utils/get-secret.js';
-import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
 import { verifyJWT } from '../../utils/jwt.js';
 import { Url } from '../../utils/url.js';
+import { generateCallbackUrl } from '../utils/generate-callback-url.js';
+import { isLoginRedirectAllowed } from '../utils/is-login-redirect-allowed.js';
 import { LocalAuthDriver } from './local.js';
-import { getSchema } from '../../utils/get-schema.js';
 export class OpenIDAuthDriver extends LocalAuthDriver {
     client;
-    redirectUrl;
     config;
     roleMap;
     constructor(options, config) {
         super(options, config);
-        const env = useEnv();
         const logger = useLogger();
         const { issuerUrl, clientId, clientSecret, clientPrivateKeys, clientTokenEndpointAuthMethod, provider, issuerDiscoveryMustSucceed, } = config;
         const isPrivateKeyJwtAuthMethod = clientTokenEndpointAuthMethod === 'private_key_jwt';
@@ -37,8 +36,6 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
             logger.error('Invalid provider config');
             throw new InvalidProviderConfigError({ provider });
         }
-        const redirectUrl = new Url(env['PUBLIC_URL']).addPath('auth', 'login', provider, 'callback');
-        this.redirectUrl = redirectUrl.toString();
         this.config = config;
         this.roleMap = {};
         const roleMapping = this.config['roleMapping'];
@@ -98,7 +95,6 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
         const client = new issuer.Client({
             client_id: clientId,
             ...(!isPrivateKeyJwtAuthMethod && { client_secret: clientSecret }),
-            redirect_uris: [this.redirectUrl],
             response_types: ['code'],
             ...clientOptionsOverrides,
         }, isPrivateKeyJwtAuthMethod ? { keys: clientPrivateKeys } : undefined);
@@ -116,7 +112,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
     generateCodeVerifier() {
         return generators.codeVerifier();
     }
-    async generateAuthUrl(codeVerifier, prompt = false) {
+    async generateAuthUrl(codeVerifier, prompt = false, callbackUrl) {
         const { plainCodeChallenge } = this.config;
         try {
             const client = await this.getClient();
@@ -132,6 +128,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
                 // Some providers require state even with PKCE
                 state: codeChallenge,
                 nonce: codeChallenge,
+                redirect_uri: callbackUrl,
             });
         }
         catch (e) {
@@ -160,7 +157,7 @@ export class OpenIDAuthDriver extends LocalAuthDriver {
             const codeChallenge = plainCodeChallenge
                 ? payload['codeVerifier']
                 : generators.codeChallenge(payload['codeVerifier']);
-            tokenSet = await client.callback(this.redirectUrl, { code: payload['code'], state: payload['state'], iss: payload['iss'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge, nonce: codeChallenge });
+            tokenSet = await client.callback(payload['callbackUrl'], { code: payload['code'], state: payload['state'], iss: payload['iss'] }, { code_verifier: payload['codeVerifier'], state: codeChallenge, nonce: codeChallenge });
             userInfo = tokenSet.claims();
             if (client.issuer.metadata['userinfo_endpoint']) {
                 userInfo = {
@@ -329,10 +326,17 @@ export function createOpenIDAuthRouter(providerName) {
         const prompt = !!req.query['prompt'];
         const redirect = req.query['redirect'];
         const otp = req.query['otp'];
-        if (isLoginRedirectAllowed(redirect, providerName) === false) {
+        if (!isLoginRedirectAllowed(providerName, redirect)) {
             throw new InvalidPayloadError({ reason: `URL "${redirect}" can't be used to redirect after login` });
         }
-        const token = jwt.sign({ verifier: codeVerifier, redirect, prompt, otp }, getSecret(), {
+        const callbackUrl = generateCallbackUrl(providerName, `${req.protocol}://${req.get('host')}`);
+        const token = jwt.sign({
+            verifier: codeVerifier,
+            redirect,
+            prompt,
+            otp,
+            callbackUrl,
+        }, getSecret(), {
             expiresIn: (env[`AUTH_${providerName.toUpperCase()}_LOGIN_TIMEOUT`] ?? '5m'),
             issuer: 'directus',
         });
@@ -341,7 +345,7 @@ export function createOpenIDAuthRouter(providerName) {
             sameSite: 'lax',
         });
         try {
-            return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt));
+            return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt, callbackUrl));
         }
         catch {
             return res.redirect(new Url(env['PUBLIC_URL'])
@@ -365,7 +369,7 @@ export function createOpenIDAuthRouter(providerName) {
             const url = new Url(env['PUBLIC_URL']).addPath('admin', 'login');
             return res.redirect(`${url.toString()}?reason=${ErrorCode.InvalidCredentials}`);
         }
-        const { verifier, prompt, otp } = tokenData;
+        const { verifier, prompt, otp, callbackUrl } = tokenData;
         let { redirect } = tokenData;
         const accountability = createDefaultAccountability({ ip: getIPFromReq(req) });
         const userAgent = req.get('user-agent')?.substring(0, 1024);
@@ -387,6 +391,7 @@ export function createOpenIDAuthRouter(providerName) {
                 codeVerifier: verifier,
                 state: req.query['state'],
                 iss: req.query['iss'],
+                callbackUrl,
             }, { session: authMode === 'session', ...(otp ? { otp: String(otp) } : {}) });
         }
         catch (error) {