Why do I get an 'interaction session not found' error when switching users with node-oidc-provider and NextAuth?

The error:

error: invalid_request
error_description: interaction session not found

typically means that when you try to log in again, the OIDC provider can’t find the interaction session data it expects to terminate (or update) as part of a logout flow. This happens only when switching users because:

1. Partial Logout: When you log out using NextAuth.js, you are ending your local session but not necessarily invalidating the session maintained on the OIDC provider. As a result, if you switch to a different user, the provider still has remnants of the old session (or expects a proper interaction) that isn’t cleared.

2. Prompt=login Behavior: Using prompt=login forces the OIDC provider to engage a fresh interaction flow. If the session (or interaction state) wasn’t properly ended on the provider side, then an attempt to start a new session with a different user might trigger a call (such as to /session/end/confirm) that expects an existing and valid interactive session. When it can’t find it, you get the error.

Handling User Switching Properly

To properly handle user switching with prompt=login, consider the following:

• Terminate the Provider Session Explicitly:
  Rather than only logging out from NextAuth.js, ensure that you also trigger a logout on the OIDC provider. Many OIDC flows include an endpoint to perform a proper logout that clears provider-side session data. This could involve redirecting the user to an OIDC logout endpoint so that the session (and any stored interaction state) is fully cleared.

• Synchronize Local and Provider States:
  Make sure that when a user signs out, both the client’s session and the OIDC provider’s session (stored as cookies or server state) are cleared. This avoids remnants of a previous authentication flow interfering with a new one.

• Review Your Logout Flow in NextAuth.js:
  NextAuth.js might log you out locally but might not propagate that logout to the OIDC provider by default. You may need to extend your logout handler (or configure NextAuth.js’s logout callbacks) so that a proper logout request is made to the OIDC provider, ensuring that the interaction session is ended on both sides.

Summary

The error occurs when switching users because the OIDC provider still has (or expects) an interaction session from the first login. Since your logout from NextAuth.js doesn’t clear that provider session, when a different user attempts to log in, the provider cannot find the expected interaction, resulting in the error. By ensuring that you explicitly terminate the OIDC session (for example, by redirecting to the provider’s logout endpoint or otherwise clearing the provider’s session state), you can avoid the error and support user switching correctly.