Per-client Application Start URL and automatic recovery from expired bookmarked login URLs

@Bidis is already working on this.

Since May 21, 2026.

# Disclaimer

This proposal is not based on actual knowledge of the underlying technical implementation of the INDICE IAM platform. It should be treated as a product-level feature request and a guide for the desired user experience, not as a suggested implementation approach.

---

# Problem

A common issue for end users is that they bookmark the IAM login/challenge URL instead of the actual client application URL.

For example, instead of bookmarking:
`https://app.contoso.com/`
the user bookmarks a transient IAM URL similar to:
`https://login.contoso.com/login?ReturnUrl=...`

This URL may contain temporary authorization/challenge parameters such as:
- ReturnUrl
- client_id
- redirect_uri
- state
- code_challenge
- code_challenge_method
- acr_values
- scopes and other OIDC/OAuth parameters

When the authorization challenge expires, any future login attempt using the bookmarked IAM URL fails. From the user’s perspective, this looks like a login problem, even though the real issue is that they are reusing an expired login transaction URL.

This creates avoidable support cases and a poor user experience.

---

# Proposed solution

Introduce a per-client Application Start URL setting in IAM, and use it to automatically recover users from expired or invalid bookmarked login/challenge URLs.

## 1. Per-client Application Start URL

IAM Admin should allow administrators to configure a stable application entry point per client.

Example:

```
Client ID: contoso-app
Application Start URL: https://app.contoso.com/
```

This URL should represent the correct page that users are allowed to bookmark and use when starting a new login flow.
The setting could be configured at the client/application level in IAM Admin.

### Desired behavior

When a user accesses an expired, invalid, or no-longer-usable IAM login/challenge URL:
1. IAM detects that the login/authorization transaction is no longer valid.
2. IAM attempts to identify the related client, where possible.
3. If the client has a configured Application Start URL, IAM automatically redirects the user to that URL (possibly keeping any ReturnURL parameter as well).
4. The client application then starts a fresh authentication flow normally.
5. If IAM cannot safely determine the client, or if no Application Start URL is configured, IAM displays a friendly recovery page explaining that the login link has expired.

Example recovery message:
```
This login link has expired.

Please access the application from its main page and try again.
```

If the Application Start URL is known, the page could include:
```
Continue to application
```
or IAM could redirect automatically.

## 2. Optional enhancement: bookmark warning text
IAM login/challenge pages could optionally display a warning informing users not to bookmark the IAM login page.

Example
```
Do not bookmark this login page.

To access this application in the future, please bookmark the application homepage instead.
```

If the Application Start URL is configured, IAM could show the correct bookmark URL:

```
To access this application later, bookmark:
https://app.contoso.com/
```

This could be controlled per client, for example:

Show bookmark warning: Yes / No
Bookmark warning text: default or custom
Display configured Application Start URL: Yes / No

---

# Expected benefits
- Reduces support tickets caused by users bookmarking expired IAM URLs.
- Improves user experience by recovering automatically instead of showing technical errors.
- Allows each client application to define its own safe entry point.
- Avoids requiring end users to understand OIDC/OAuth concepts such as state, ReturnUrl, or PKCE challenges.