andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-09 15:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(login): Redirect to IDP flow when password auth is disabled (#10839)

Browse Source 
Closes #10671

# Which Problems Are Solved

Users with only password authentication method were immediately shown an
error "Username Password not allowed" when
`loginSettings.allowUsernamePassword` was set to false. However, the IDP
flow could potentially allow the user to register a new account or link
an existing account, providing a better user experience than a dead-end
error.

# How the Problems Are Solved

- Modified single password method case to attempt IDP redirect before
showing error
- This allows users to potentially register or link accounts through the
IDP flow instead of hitting an immediate error
- Only show error as last resort when no IDP alternative is available
This commit is contained in:
Max Peintner
2025-10-07 05:47:58 +00:00
committed by GitHub
parent 6da380628d
commit 695db96745
2 changed files with 563 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/login/src/lib/server/loginname.ts
+15 -2
View File
@@ -255,6 +255,12 @@ export async function sendLoginname(command: SendLoginnameCommand) {
switch (method) {
case AuthenticationMethodType.PASSWORD: // user has only password as auth method
if (!userLoginSettings?.allowUsernamePassword) {
// Check if user has IDPs available as alternative, that could eventually be used to register/link.
const idpResp = await redirectUserToIDP(userId);
if (idpResp?.redirect) {
return idpResp;
}
return {
error: "Username Password not allowed! Contact your administrator for more information.",
};
@@ -312,7 +318,7 @@ export async function sendLoginname(command: SendLoginnameCommand) {
if (methods.authMethodTypes.includes(AuthenticationMethodType.PASSKEY)) {
const passkeyParams = new URLSearchParams({
loginName: session.factors?.user?.loginName,
altPassword: `${methods.authMethodTypes.includes(1)}`, // show alternative password option
altPassword: `${methods.authMethodTypes.includes(AuthenticationMethodType.PASSWORD) && userLoginSettings?.allowUsernamePassword}`, // show alternative password option only if allowed
});
if (command.requestId) {
@@ -327,7 +333,14 @@ export async function sendLoginname(command: SendLoginnameCommand) {
} else if (methods.authMethodTypes.includes(AuthenticationMethodType.IDP)) {
return redirectUserToIDP(userId);
} else if (methods.authMethodTypes.includes(AuthenticationMethodType.PASSWORD)) {
// user has no passkey setup and login settings allow passkeys
// Check if password authentication is allowed
if (!userLoginSettings?.allowUsernamePassword) {
return {
error: "Username Password not allowed! Contact your administrator for more information.",
};
}
// user has no passkey setup and login settings allow passwords
const paramsPasswordDefault = new URLSearchParams({
loginName: session.factors?.user?.loginName,
});