You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/authenticate/auth-guides/pass-params-idp.mdx
+26-28Lines changed: 26 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,10 +12,11 @@ relatedArticles:
12
12
You can pass provider-specific parameters to an Identity Provider (IdP) during authentication. These are also known as 'upstream params'. The values your pass can either be static per connection or dynamic per user.
13
13
14
14
There's a number of reason why you might want to use upstream params:
15
+
15
16
- to create a smoother sign in experience - by passing the email through
16
17
- to offer an account switcher (such as the Google account switcher) during sign in
17
18
18
-
Upstream params are available for OAuth 2.0 connections, e.g. [social connections](/authenticate/social-sign-in/add-social-sign-in/), [Entra ID OAuth 2.0 enterprise connection](/authenticate/enterprise-connections/azure/), and as part of [advanced configurations](/authenticate/enterprise-connections/advanced-saml-configurations/) in SAML connections.
19
+
Upstream params are available for OAuth 2.0 connections, e.g. [social connections](/authenticate/social-sign-in/add-social-sign-in/), [Entra ID OAuth 2.0 enterprise connection](/authenticate/enterprise-connections/azure/), and as part of [advanced configurations](/authenticate/enterprise-connections/advanced-saml-configurations/) in SAML connections.
19
20
20
21
## Limitations
21
22
@@ -31,28 +32,26 @@ The Upstream parameter field accepts JSON and the structure is as follows:
31
32
32
33
```json
33
34
{
34
-
"<param_name_to_pass>": {
35
+
"<param_name_to_pass>": {
35
36
"value": "<your_hardcoded_value>"
36
37
}
37
38
}
38
-
39
39
```
40
40
41
41
Replace `<param_name_to_pass>` with the name of the parameter you wish to pass upstream to the IDP.
42
42
Replace `<your_hardcoded_value>` with the value of the parameter you wish to pass upstream.
43
43
44
44
### Example: Force the google account selector to display on sign in
45
45
46
-
If you want Google to always show the account selector even if the user is already logged in with a Google account, pass the `prompt=select_account` parameter from Kinde.
46
+
If you want Google to always show the account selector even if the user is already logged in with a Google account, pass the `prompt=select_account` parameter from Kinde.
47
47
This is how that would look:
48
48
49
49
```json
50
50
{
51
-
"prompt": {
51
+
"prompt": {
52
52
"value": "select_account"
53
53
}
54
54
}
55
-
56
55
```
57
56
58
57
Now, when your user clicks on the Google button and Kinde creates the URL to redirect to Google, it will append`&prompt=select_account`.
@@ -65,34 +64,34 @@ This is the structure.
65
64
66
65
```json
67
66
{
68
-
"<param_name_to_pass>": {
67
+
"<param_name_to_pass>": {
69
68
"alias": "<dynamic_param_name>"
70
69
}
71
70
}
72
-
73
71
```
74
72
75
73
The `alias` keyword tells Kinde which parameter from your auth url to use, and the value to pass upstream to the IDP.
76
74
77
75
Here is an example where we provide `login_hint` as part of the auth URL, where the email [`&[email protected]`](mailto:&[email protected]) is included on the URL.
In this case both Kinde and the IDP use the parameter name `login_hint` so the configuration is the same on both sides:
90
89
Add this to the connection configuration:
91
90
92
-
}
91
+
}
93
92
}
94
93
95
-
```
94
+
````
96
95
97
96
In this case we are saying pass the `login_hint` parameter upstream to the IDP with the value Kinde received in the `login_hint` auth url param. So `&[email protected]` would be passed on to the provider.
98
97
@@ -104,7 +103,7 @@ Where the `alias` becomes especially powerful is when you want to re-map a param
104
103
"alias": "login_hint"
105
104
}
106
105
}
107
-
```
106
+
````
108
107
109
108
In this case we are saying pass the `username` parameter upstream to the IDP with the value Kinde received in the `login_hint` auth url param. We remap the email value from `login_hint` to `username` and the parameter `&[email protected]` would be passed on to the IDP.
110
109
@@ -118,9 +117,9 @@ If the user enters `[email protected]` in the Kinde email field with the followi
118
117
119
118
```json
120
119
{
121
-
"login_hint": {
122
-
"alias": "login_hint"
123
-
}
120
+
"login_hint": {
121
+
"alias": "login_hint"
122
+
}
124
123
}
125
124
```
126
125
@@ -130,14 +129,13 @@ You can send multple parameters this way and mix-and-match between dynamic and s
Copy file name to clipboardExpand all lines: src/content/docs/developer-tools/about/using-kinde-without-an-sdk.mdx
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,7 +46,7 @@ You will need to use this redirect URL in the following step.
46
46
Your users must be redirected from your product to Kinde to sign up or sign in securely. The redirect URL on your product side would look like the following:
@@ -61,6 +61,7 @@ Kinde supports all the standard OAuth 2 request parameters as well as a few addi
61
61
Kinde also supports the PKCE extension, in which case the `code_challenge` and `code_challenge_method` parameters are also required. This is recommended for mobile apps and single page applications (SPAs).
62
62
63
63
## Handling successful auth for desktop and mobile apps
64
+
64
65
If you offer mobile and desktop apps, as well as access through a browser, you'll need to handle the post-authentication browser state. Rather than leaving a hanging screen, you can show users a success page. To do this, add the `is_use_auth_success_page` parameter to the authorization URL. See the [Request prameters](/developer-tools/about/using-kinde-without-an-sdk/#request-parameters) section below.
0 commit comments