Force the user to login with Entra ID, take away the option to use google
A
Additional Magpie
Is there a way to have the Rewst login screen to either
- Go directly to the Entra login OR...
- Remove any other login options from the Rewst login screen
For example, we don't want to give users an option to login using a google account.
So perhaps have a toggle switch in the "View Direct URL" next to each URL that if enabled takes a user directly to the Entra ID login screen, and if not enabled, use your default login screen as it is.
If that makes any sense 😅
Log In
E
Eligible Anteater
Some tracing in case it helps scope this. The current behavior traces to one hardcoded parameter rather than a missing feature, so this may be a smaller change than it looks.
Every authorize call from the login route carries prompt=select_account, and Auth0 forwards it to Entra verbatim. That's why it's two clicks, not one: it suppresses the Auth0 SSO session (chooser screen), then forces Entra's account picker even with exactly one account signed in.
I tested the simple GET approach and it doesn't work today. /api/auth/login?connection=<name> produces an authorize call with no connection parameter at all, and appending it to a form URL just nests it inside returnTo. The login route only honors returnTo, so there's no client-side workaround.
Options, smallest first:
- Forward connection and login_hint into authorizationParams on the login route. Opt-in, nothing changes for anyone who doesn't pass them.
- Make prompt=select_account conditional rather than always-on, so it's sent only when a user explicitly switches accounts.
- A default IdP setting per org, plus the per-URL toggle suggested in the original post.
This also blocks the iFrame and Teams embedding ask by Sympathetic Parrotfish, since prompt=select_account makes silent auth impossible by definition.
S
Sympathetic Parrotfish
This would be a great benefit for end users leverage existing IDP services they're used to. Even a simple HTTP GET in the url would be great.
This would also be even more useful for iFrames embedded in existing Service Portals (eg HALO) or Teams Applications (Microsoft automatically)
L
Lemon chiffon Echidna
I'll second this.