Feature Request: login_hint

[bard]

Expected Behavior

The optional login_hint URL parameter (spec) gets relayed to the identity provider:

$ curl -I https://example.com/oauth2/start?login_hint=bob@example.com
HTTP/2 302 
location: https://id.example.com/auth/realms/example/protocol/openid-connect/auth?
approval_prompt=force&client_id=oauth2proxy&login_hint=bob%40example.com&redirect_uri=...

Current Behavior

The login_hint parameter is lost:

$ curl -I https://example.com/oauth2/start?login_hint=bob@example.com
HTTP/2 302 
location: https://id.example.com/auth/realms/example/protocol/openid-connect/auth?
approval_prompt=force&client_id=oauth2proxy&redirect_uri=...

Possible Solution

The naïve implementation I'm currently using: bard/oauth2-proxy@master...login_hint

Context

This would decrease friction and mistakes during business flows such as invitation, or admin-created accounts with temporary password:

Example without login_hint:

1. receive email that says "log in here [https://example.com/oauth2/start] with your email address bob@example.com and invitation code ABC123"
2. user clicks on link and is redirected to id.example.com
3. user enters email (hopefully the same as mentioned by the invitation email; and hopefully without mistakes)
4. user enters invitation code

Example with login_hint:

1. receive email that says "log in here [https://example.com/oauth2/start?login_hint=bob@example.com] with invitation code ABC123"
2. user clicks on link and is redirected to id.example.com
3. user enters invitation code

Your Environment

• Version used: 7.1.3

[ianroberts]

I'm discussing a more general solution in #1314 to support forwarding any query parameters from /oauth2/start on to the IdP login URL.

[ianroberts]

I've started a PR #1418 but unsure what's the best format for the configuration, if you have any suggestions please add them on there.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[ianroberts]

There's been no movement so far on #1314 but I am still interested in getting that or something similar integrated if possible.

[ianroberts]

#1418 has been merged, so this will be possible in the next release if you're prepared to switch to the "alpha" config style.