Repository navigation
Replies: 1 comment
|
Hi @Dunge, what you’re seeing is expected with the Organization Identity-First flow. In this flow, If the org-linked IdP has Redirect when email domain matches enabled (docs), auto-redirect is expected.
Also, this behavior was intentionally implemented in #39432 (from #38228). So if your goal is “prefill only, but still show first page”, there is no built-in toggle for that in this authenticator right now. Practical options are:
|
Uh oh!
There was an error while loading. Please reload this page.
I'm using the organization feature with a "Organization identity - First Login" flow so that only the email field is available in the login page and then redirect to the proper idP based on the domain and it works fine.
I want to optionally possibly pass the e-mail to prefill the field with the login_hint parameter like this:
var authUrl = $"{ssoUrl}/realms/master/protocol/openid-connect/auth" +
$"?client_id={clientId}" +
$"&response_type=code" +
$"&scope=openid%20profile%20email" +
$"&redirect_uri={_redirect}" +
$"&ui_locales={cultureInfo}" +
$"&login_hint={_viewModel.UserName}" +
$"&state={state}" +
$"&nonce={nonce}";
Now when I use this login_hint parameter, it automatically redirect to the idP instead of prefilling the form. Which is not exactly a good flow for my application because it's not obvious the username from my previous interface will be used in the SSO connection.
Based on the documentation, the parameter
kc_idp_hintis what should be used to automatically redirect to the idP page, whilelogin_hintshould only be used to prefill the field, but it doesn't seem to be the case?All reactions