Pre-fill OIDC login form...

[chibenwa]

Why ?

See #2317

GIVEN I am on mobile (I need to resolve the JMAP server)
THEN the mobile app prompt for mail address
AND use SRV records to locate the JMAP server
AND discover the OpenID configuration with webfinger
AND redirects to the SSO

On the SSO login page, the user is prompted again for login and password.

So the user has to input his login twice (!)

Note that for web we can preconfigure the endpoint and the sso configuration in order to skip webfinger/srv records. On web we can just blindly redirect to the SSO so we do not need to cary over the login information to the SSO.

How?

If available the mobile application can pass to the SSO the mail address as a parameter.

Apparently we could use the registration parameter that allows to pass a free form JSON to that end:

Example:

  HTTP/1.1 302 Found
  Location: openid://?
    response_type=id_token
    &client_id=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile
    &state=af0ifjsldkj
    &nonce=n-0S6_WzA2Mj
    &registration=%7B%22mailaddress%22%3A%22bob%40domain.tld%22%7D

(url decoded {"mailaddress":"bob@domain.tld"} )

Then a LemonLDAP plugin could capture this and prefill the login field, potentially applying a pre-configured (on lemon side) normalization step - for instance keep the local part.

Caracteristic:

• Downgrade friendly: if the SSO do not understand this parameter then it would skip it and let the user input his name a second time...

[guimard]

Why not using "login_hint" ?

[chibenwa]

There is a field for that (already implemented in SS0): login_hint. Note: was implemented following Tmail-Team request 😉

Why not using "login_hint" ?

INDEED

[chibenwa]

I did put this in the sprint let's add login_hint

[hoangdat]

hi @guimard
cc @chibenwa

I tested with govmu account, login_hint still not work when we open auth.*****. Even it works with linagora and mail (dev) with keycloak.

Do you know the reason why?

[chibenwa]

Likely a LemonLDAP plugin is not displayed there.

[hoangdat]

@rezk2ll can you update sign-up page to support login_hint.

[guimard]

hi @guimard cc @chibenwa

I tested with govmu account, login_hint still not work when we open auth.*****. Even it works with linagora and mail (dev) with keycloak.

Do you know the reason why?

Because this feature isn't deployed yet in govmu, try in preprod

[hoangdat]

hi @guimard , still not work in preprod

[guimard]

hi @guimard , still not work in preprod

Could you retry ?