authentication request with login_hint

[manjot-singh-saveonfoods]

need support for making an auth request with a login_hint param in a flow where there are multiple IDPs configured and IDPDiscoveryUrl page is being used to select the IDP based on a username.

Example Scenario:

1. User accesses the application.
2. User is redirected to a login page containing a text field, which is also configured as IDPDiscoveryUrl page.
3. User enters a username and clicks 'next' button.
4. User is redirected to appropriate IDP for auth based on the entered username. ex. If username entered is a numeric id, user is redirected to one IDP for auth, but if it's an email id, user gets redirected to another IDP.

This flow is currently possible with mellon, but only issue is the redundancy of entering a username twice, first at the IDP selection and then at IDPs auth page as there is no way to make use of the login_hint url param that IDPs support( i know of Google Identity and Microsoft identity platform)

[thijskh]

Hi!. mod_auth_mellon is an implementation of the SAML 2.0 protocol. login_hint is an aspect of the OpenID Connect protocol.

As far as I'm aware there's no standard or widely supported way in SAML to pass the username to a SAML IdP. There's the <subject> element which could be in the authnrequest but I doubt IdP's currently support it; saml2int.org also forbids its use. So Mellon cannot send this, but this is mainly because there are to my knowledge no mainstream IdPs that can receive it.

[manjot-singh-saveonfoods]

Hi! Thanks for the quick reply.
I have mellon setup with azure AD as IDP and I intercepted the auth redirection in browser, if I just add another query param login_hint to the url, it works as expected, asks me directly for password without prompting for a username.

https://login.microsoftonline.com/tenant-id/saml2?login_hint=&SAMLRequest=&RelayState=
this works fine.

[thijskh]

Good to know. However this is a proprietary extension of this vendor and not part of the SAMLRequest an SP sends.