Repository navigation
Replies: 3 comments
|
The same idea expressed in code form : gscokart@96d7dd8 |
|
IMO when a user has no password, but does have a single linked IdP and that IdP is linked to an organisation they should always be redirect. Even if user is not managed by the organisation. After all that's the only way they can sign in right now. Did I understand correctly that this want you want as well and what gscokart@96d7dd8 implements? This would also be an alternative solution to my problem in #47136. It's not quite the same, but in our use case users would actually just have a single IdP and no password. They might however not be managed users, because we may need to retain the accounts separately from their organisation membership. |
|
Yes, it could solve your problem as well. Reading your description, I however realize we placed ourself into a context where organization is enabled. However, the feature we are discussing is a feature for any identity first login flow. I'm however not sure we should consider an identity first login flow without organization. As you mention, there is indeed some exposure of about which email (or userid) are defined. With organization support, we need this identity first. But whithout organization, it is probably safer to keep avoiding indentity first login. For my use case anyway, I only need it when organization are enabled. |
Uh oh!
There was an error while loading. Please reload this page.
The default authentication flow used when an organization is enabled first prompts for the email, and then automatically redirects the user to the IdP when there is a single option available (i.e., when the user has no password and only one federated identity linked to the organization).
This behavior is useful, but it does not seem consistent when the user has other federated identities. Why do we ask the user to choose an identity provider when they have a password, but not when they have other linked IdPs?
Additionally, this automatic behavior is only enabled for managed members, and not for other members.
I am currently exploring the support for IdPs shared or accepted by multiple organizations (#31705), and I would like to discuss the possibility of extending the automatic IdP redirection to realm-level IdPs.
My first idea would be to update
OrganizationAuthenticator.tryRedirect()with the following logic:This appears to be a minor change that respects the current behavior, while only modifying the flow in situations where the user would have to select the single IdP they can use anyway.
We could however change it a little further (which would change further the behavior in some case) by really redirecting is there is only one option. (So a managed user that also has a realm idp federated identity would have to choose, while now it doesn't).
Other possibility would be to allow to configure in the authenticator step (or as an option for the organization) if automatic redirection should be done.
My preference would go to the simplest one, with less changes, but what do other think about such enhancement ?
All reactions