search

okta / okta-auth-js

The official js wrapper around Okta's auth API
Other
446 stars 257 forks source link

login_hint passthrough with idx authentication API. #1223

Open kevinklitzke opened 2 years ago

kevinklitzke commented 2 years ago

Describe the feature request?

When using signInWithRedirect() it is possible to pass both the idp as well as the loginHint parameter. When the IdP specified is also an OIDC IdP, the loginHint is transparently passed through to the to the destination IdP. This is a very handy way to pass additional contextual information along to the IdP without having to resort to some backchannel.

I have been attempting to replicate this behavior with the new IDX API (via the interaction code flow) to no avail.

Initially I attempted to simply tack on the login_hint to the /authorize call, but that comes back with a generic "invalid_request: The request contained multiple parameters with the same name".

Looking at the interaction code flow, it seemed like it might be possible to use the /interact endpoint to pre-populate the login_hint, however that was not an available parameter to idx.startTransaction(). I then modified the AuthJS code to expose loginHint as a parameter and that indeed makes it to the POST /interact call, but it seems to to be ignored or at the very least is not passed through to the destination IdP.

Is there a way to achieve a similar result to what is described above with signInWithRedirect() but instead using the idx API?

New or Affected Resource(s)

Lack of this functionality (or a reasonable alternative) will impact the migration from the Auth API to the Idx API. In the mean time a combination of both APIs can be used, however this adds needless complexity to the solution.

Provide a documentation link

No response

Additional Information?

No response

aarongranick-okta commented 2 years ago

@kevinklitzke Thanks for the inquiry. The SDK supports both "up front" and "on demand" approaches to handling login remediations: https://github.com/okta/okta-auth-js/blob/master/docs/idx.md#up-front-approach

It sounds like what you are describing can be handled by adding username to the options object passed to the idx.authenticate entry point (or idx.proceed if you have already called idx.startTransaction)

https://github.com/okta/okta-auth-js/blob/master/docs/idx.md#idxauthenticate