SSO-only account cannot connect Zotero desktop: "Connect Zotero" requires password confirmation

[mweber0]

Version: 1.0.0-beta.2
Setup: Caddy reverse proxy (TLS), ALTERO_PUBLIC_URL set, ALTERO_OPEN_REGISTRATION=false
Identity provider: Microsoft Entra ID via OpenID Connect

What happens

1. User signs in to the web interface via the OIDC provider - works.
2. In Zotero desktop: Settings -> Account -> Log In opens the "Connect Zotero" (see screnshot below) page in the browser.
3. The page asks the user to confirm their password before the client is approved.
4. The account was created automatically on first sign-in via the OIDC provider and has never had a local password, so there is nothing to enter. The link cannot be completed.

A fresh SSO sign-in directly before clicking "Log In" does not change this.

Is this intended behaviour, or is re-authentication via the sign-in provider planned for the desktop approval step? Is there a supported way for SSO-only users to link a client today?

Many thanks!

Michael

[eseifert]

Thanks for the report. This is a bug, not intended behavior.

The server already lets accounts without a password approve a client: instead of a password, it accepts a re-authentication at the identity provider within the last five minutes. What’s missing is logic in the web interface. At the moment the “Connect Zotero” page, like the other pages that ask for confirmation, only knows how to ask for a password.

A fresh SSO sign-in doesn’t work on purpose, because Entra can complete it silently from its own session. Re-authentication sends prompt=login, which makes the directory actually ask.

Until this is fixed, there are two workarounds:

As the user (untested against Entra, but it's the path the server implements):

1. Start the login in Zotero and copy the token value from the Connect page's address (…/app/link?token=XYZ).
2. In the same browser, open https://<your-host>/web/auth/sso/<provider-slug>/start?purpose=reauth&next=%2Flink%3Ftoken%3DXYZ, using the slug from your normal SSO sign-in link. After you sign in again, you're sent back to the Connect page.
3. Within five minutes, click Connect with the password field left empty.

As the administrator, on the server:

altero login list                      # shows the waiting login and its token
altero login approve <token> <username>

If you try the first workaround, I'd be glad to hear whether it works with Entra.

[eseifert]

A fix for this will be in the next release.

[mweber0]

Thanks alot!
The first workaround works fine with Entra - we were now able to Log In in Zotero.

Many thanks for the swift response!