Sub claim is missing error after disabling server-side sessions about identityserver

[brockallen]

Patch 6.2.4 has been released. Please have a look and if there is still an issue let us know. Thanks!

[brockallen]

In summary, we are encountering a large amount of "sub claim missing"

Hmm, this is interesting. I just went to repro what you describe and what I see is that the result of the auth handler is successful, but the user is also considered anonymous. Normally when the user has no session the result of the auth handler is not successful. So while having a successful authentication but also an anonymous user is a very bizarre combination, I guess it's legal. And I checked and we're not explicitly checking for it. I'm really surprised in the 10+ years of this code, this is first time we've seen this situation!

So keep your server side sessions enabled and let us look into a fix we can do internally.

Update: we have a PR suggested, which I think will address the issue. What's your preferred timeframe for a fix?

[brockallen]

Another update -- the PR was approved and merged, so we'll be releasing a patch ASAP.

[deanddm]

Thanks so much @brockallen for the fast turnaround. Will get this tested soonest.

[brockallen]

@deanddm I assume no news is good news? :)