Silent SSO #13
Silent SSO #13
Conversation
|
FYI: I want to see if I can get the change to |
app/index.js
Outdated
| // | ||
| // See: https://github.com/siacomuzzi/passport-openidconnect/blob/master/lib/strategy.js#L338 | ||
| Auth0Strategy.prototype.authorizationParams = (options) => { | ||
| return options; |
There was a problem hiding this comment.
Just realised, shouldn't this be options => options?
There was a problem hiding this comment.
You're right. I think I didn't use it already because originally I was using Object.assign(options, {}) and the body of the function was a bit "long" to use the shorthand.
I wonder if I should be defensive here and return options || {}; - Probably not worth it as we control the code and chance of not passing options are very thin.
(I'm trying to write some tests to have something like this upstream - in that case it makes more sense to be defensive)
There was a problem hiding this comment.
Don't ask for confirmation when user already logged in Auth0 SSO. By passing `?prompt=none` in the `/authorize` request Auth0 will not ask to confirm the identity when already logged in SSO. The effect will be that the user will be transparently be logged in the application (RStudio in this case). NOTE: When `?prompt=none` is passed to `/authorize` but the user is *not* logged in SSO the user will not be promped to login and therefore can't be logged in. In this case the application redirects to `/login` again by passing `?prompt=true` so that the user can login. SEE: https://auth0.com/docs/api-auth/tutorials/silent-authentication
xoen
force-pushed
the
ag--auth0-hosted-login-page
branch
from
df39b20
to
558de3c
Compare
What
Don't ask for confirmation when user already logged in Auth0 SSO.
By passing
?prompt=nonein the/authorizerequest Auth0 will notask to confirm the identity when already logged in SSO.
The effect will be that the user will be transparently be logged in the
application (RStudio in this case).
Notes
When
?prompt=noneis passed to/authorizebut the user is notlogged in SSO the user will not be promped to login and therefore can't
be logged in. In this case the application redirects to
/loginagain bypassing
?prompt=trueso that the user can login.See