Azure / Azure/static-web-apps

Can't pass additional parameters to custom auth provider's /authorize

Open
#1,668 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

When users hit `/.auth/login/`, the /authorize url generated ditches any additional query string parameters that were provided.

This is a problem for example when you want to implement Auth0 Organizations invite flow. /authorize will need to have query string params: 'invitation', 'organization' which are dynamic.

**Describe the solution you'd like**
When query string params are included in a request to `/.auth/login/`, they are forwarded on in the /authorize url.

**Describe alternatives you've considered**
Hitting an alternative custom route just for this signup invite flow. Suboptimal because I want SWA to block unauthorized users, and it breaks out of the SWA auth handling.

**Additional context**
I'm following this guide which works for them because they handle the login flow using a JS library from within their app. It fails for us because SWA built-in auth handling cannot handle query string parameters.
https://developer.auth0.com/resources/labs/saas/invite-workflow-using-the-auth0-organizations-invitation-feature#integrate-support-for-auth-0-organization-invite

This is my staticwebapp.config.json

```
{
"navigationFallback": {
"rewrite": "/index.html",
"exclude": ["/assets/*"]
},
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"authzero": {
"registration": {
"clientIdSettingName": "AUTH0_CLIENT_ID",
"clientCredential": {
"clientSecretSettingName": "AUTH0_CLIENT_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https:///.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile"]
}
}
}
}
},
"routes": [
{
"route": "/login",
"rewrite": "/.auth/login/authzero"
},
{
"route": "/logout",
"rewrite": "/.auth/logout"
},
{
"route": "/.auth/login/github",
"statusCode": 404
},
{
"route": "/.auth/login/twitter",
"statusCode": 404
},
{
"route": "/.auth/login/aad",
"statusCode": 404
},
{
"route": "/*",
"allowedRoles": ["authenticated"]
}
],
"responseOverrides": {
"401": {
"redirect": "/.auth/login/authzero?post_login_redirect_uri=.referrer",
"statusCode": 302
}
}
}
```

I've also tried the 'loginParameterNames' attribute in 'login' to no avail. It seems this only works to provide static query string parameters e.g. 'invitation=test'. This did not work for dynamic query params:

```
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile"],
"loginParameterNames": ["invitation", "organization", "organization_name"]
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.