Unsolicited SSO handler for OIDC?

[Lukas Hämmerle]

Thank you Scott and Henri for all the details.

"Initiating Login from a Third Party" looks promising. Then again the 
OIDC RP we are testing with does not seem to support this at first 
sight... Using random values for nonce/state/code_challenge is fine for 
the IdP but not for this RP. So, it looks that there is no generic 
solution that works for all RPs.

Best Regards
Lukas


On 20.11.2024 09:02, Henri Mikkonen wrote:
> Hi Lukas,
> 
> On 20.11.2024 9.33, Lukas Hämmerle via users wrote:
>>
>> Well, it's also quite useful for our use case in which users are sent 
>> users to some page e.g. to add some attributes to their account and 
>> then redirect them via the IdP (which verifies providerId and target 
>> arguments) back to the login page and then after successful 
>> authentication immediately to the service they wanted to access. This 
>> works even if the user already had a session on the service (where 
>> e.g. some required attribute was missing).
>>
>> Something similar is probably not that easy to implement with OIDC.
> 
> For me it sounds like the "closest match" (even though it's quite 
> different) in the OIDC-world would be the sequence specified at the 
> section 4 of the OIDC core [1] ("Initiating Login from a Third Party"). 
> Anyway, the login initiation endpoint is an RP feature and probably not 
> implemented by many of them.
> 
> BR,
> Henri.
> 
> https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin

-- 
Lukas Hämmerle
Trust & Identity
M +41 44 268 15 15
T +41 44 268 15 64

Switch
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland

https://switch.ch  https://swit.ch/linkedin