When an unknown user logs in via external identity provider, a webhook is triggered. The target service can register the user and send back their credential ID. If the response contains a valid credential_id, the login proceeds as successful.
Registration webhook
To enable the webhook, configure registration_webhook_uri in [seacatauth:external_login].
The webhook JSON payload contains
provider_type - the type of the identity provider (e.g. google or appleid),
authorization_response - response query parameters without the authorization code,
user_info - OpenID UserInfo-like claims about the logged in user (mandatory sub, optional email, preferred_username etc.). The actual claims differ from provider to provider and also depend on your client's scope and configuration.
A successful response must contain a valid credential_id of the created credentials. Otherwise, the response is considered error and the login results in failure.
closes #282
When an unknown user logs in via external identity provider, a webhook is triggered. The target service can register the user and send back their credential ID. If the response contains a valid
credential_id
, the login proceeds as successful.Registration webhook
registration_webhook_uri
in[seacatauth:external_login]
.provider_type
- the type of the identity provider (e.g.google
orappleid
),authorization_response
- response query parameters without the authorizationcode
,user_info
- OpenID UserInfo-like claims about the logged in user (mandatorysub
, optionalemail
,preferred_username
etc.). The actual claims differ from provider to provider and also depend on your client's scope and configuration.credential_id
of the created credentials. Otherwise, the response is considered error and the login results in failure.Example
Config:
Request (from Seacat Auth):
Response (from the webhook client):