authgear / authgear/authgear-server
Authentication request support "none" then fallback to authentication
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Background
The OIDC spec restricts that when `prompt` contains the value of `"none"`, "The Authorization Server **MUST NOT** display any authentication or consent user interface pages. An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent for the requested Claims or does not fulfill other conditions for processing the request."
ref: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
However, It is possible for a use case that the UX allows end-users to either: see nothing if they were authenticated, or see the login page if not they were not authenticated.
## Proposal
- In SDK allow setting a parameter to the authentication method, that performs the above use case logic.
or
- The server accept a custom prompt value that is not defined in the spec, that performs the above use case logic.
Contributor guide
Research direction
Start with the OIDC Core AuthRequest reference and trace how authentication requests are handled in the SDK and server. Clarify which proposal is intended, then verify that an already authenticated user sees no UI while an unauthenticated user can reach login without violating the specified prompt behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100