#Launch URL to actually trigger login

1 messages · Page 1 of 1 (latest)

rose root
#

Hey,

I've a problem and no more ideas how to solve it.
In authentik I implemented several oauth (e.g. wordpress, nextcloud) providers and one SAML provider (zammad).

I want to achieve the following: When clicking on the cards in the overview (or when calling the launch URL https://xya.de/application/launch/wordpress/) I want it to automatically initiate the login process on the respective applications website, without the users having to click "login with authentik" again.
For now it only leads to the respective page where users have to click manually "login with authentik" – only to be redirected to authentik (with the respective clientId and a state code) which performs the login process perfectly and redirects to the application correctly.

I have this problem with all the oauth providers. The SAML provider does this perfectly fine and offers the URL: https://xya.de/application/saml/zammad/sso/binding/init/

Has anyone got an idea what I configured wrong? Or is this expected behavior and not solvable?

Thanks a lot

xya.de

This domain may be for sale!

xya.de - Xya Resources and Information.

xya.de is your first and best source for all of the information you’re looking for. From general topics to more of what you would expect to find here, xya.de has it all. We hope you find what you are searching for!

umbral hedge
#

"IdP initiated" is a thing in SAML2 (this is what you are using with .../binding/init) but not with OpenID Connect/OAuth2.

AFAIK, either :

  • your application have a specific option to bypass the integrated login page
  • you can maybe add a custom JS script on the login page (depending of the app)
  • perhaps the the "Login with Authentik" button is a link to an endpoint/add a get parameter to the url (i.e. app.local/login/oauth or app.local/login?mode=oauth) . You can then set the "Lauch URL" to this endpoint.

Learn more about SP and IdP initiated SSO, what it is , and specific differences between SP vs IdP initiated Single Sign-On SSO login.

Manage applications | authentik

Managing the applications that your team uses involves several tasks, from initially adding the application and provider, to controlling access and visibility of the application, to providing access URLs.

rose root
#

ok thanks, but actually quite sad that this isn't a default option. beaucse your mentioned third option doesn't work with the majority of my options so far (because the generate some extra query parameters or it works but not when already logged in ... )

it feels quite absurd not to be able to initiate the login process from within the authentication service, but only "externally"