authgear / authgear/authgear-server

Authentication request support "none" then fallback to authentication

Open
#1,450 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Background

The OIDC spec restricts that when `prompt` contains the value of `"none"`, "The Authorization Server **MUST NOT** display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request."
ref: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

However, It is possible for a use case that the UX allows end-users to either: see nothing if they were authenticated, or see the login page if not they were not authenticated.

## Proposal

- In SDK allow setting a parameter to the authentication method, that performs the above use case logic.

or

- The server accept a custom prompt value that is not defined in the spec, that performs the above use case logic.

Contributor guide

Open the contributing guide

Research direction

Start with the OIDC Core AuthRequest reference and trace how authentication requests are handled in the SDK and server. Clarify which proposal is intended, then verify that an already authenticated user sees no UI while an unauthenticated user can reach login without violating the specified prompt behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.