You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In my current project we want to use a government provided OAuth2 provider to give our users the opportunity to link and log in with this, instead of their credentials. But, we are required to check if the data we get from the OAuth2 provider matches our user. If not, we need to cancel linking.
This is really easy, if someone just tries to log in with the Provider, triggering First Broker Login. But until now, I haven't found any path I could nicely inject an SPI into for Client Initiated Account Linking ( which is executed when you either link an account via the account console, or start linking via the API ).
So a workaround would be to log out the user and redirect them to authenticate with the OAuth provider. But that's really bad UX in our opinion. And since I'm sure we are not the only ones who come up with such a requirement, this led me here.
Proposal
Add an Authentication Flow Binding for Client Initiated Account Linking. This would ideally allow using Authenticator SPIs to do some logic in f.e. IdentityBrokerService.performAccountLinking. Where we have both the local UserModel and the FederatedIdentityModel that should still have the claim data in the token.
Outcome
Can add custom verification or other authentication steps on account linking. Enabling simple implementation of such requirements.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Where this comes from
In my current project we want to use a government provided OAuth2 provider to give our users the opportunity to link and log in with this, instead of their credentials. But, we are required to check if the data we get from the OAuth2 provider matches our user. If not, we need to cancel linking.
This is really easy, if someone just tries to log in with the Provider, triggering First Broker Login. But until now, I haven't found any path I could nicely inject an SPI into for Client Initiated Account Linking ( which is executed when you either link an account via the account console, or start linking via the API ).
So a workaround would be to log out the user and redirect them to authenticate with the OAuth provider. But that's really bad UX in our opinion. And since I'm sure we are not the only ones who come up with such a requirement, this led me here.
Proposal
Add an Authentication Flow Binding for Client Initiated Account Linking. This would ideally allow using Authenticator SPIs to do some logic in f.e. IdentityBrokerService.performAccountLinking. Where we have both the local UserModel and the FederatedIdentityModel that should still have the claim data in the token.
Outcome
Can add custom verification or other authentication steps on account linking. Enabling simple implementation of such requirements.
All reactions