3 people 512a4199c9 fix(login v1): handle automatic re-auth using id_token_hint properly (#11326) ...

# Which Problems Are Solved

A customer reported that when the session in console expires and the
user is prompted to re-authenticate, users get a "mfa required" error
after the re-authentication, resp. after a redirect to the login.
Because of the login policy settings, they're not required to actively
re-authenticate, but are automatically signed-in again and then get the
error.

It was discovered, that the problem is due to the login v1 loading the
wrong login policy (from the default org or instance default) instead of
the user's organization. If there are differences in the allowed second
factors, e.g. if the user's organization allows OTP Email, but the
default policy doesn't allow that and neither policy enforces MFA, then
the login will not check for 2FA/MFA. The then created new OIDC session
/ tokens won't contain any MFA information, which results in the
described error.

# How the Problems Are Solved

When creating the auth request internally, we now check for a userID set
by the id_token_hint. In case it is set, the corresponding user will be
loaded already and the request will be aggregated with their information
incl. the organization id.
A `selectUser` function has been added for this and the existing
`SelectUser` used in the account selection page has been updated to use
the new function.

# Additional Changes

None

# Additional Context

- reported through support
- requires backport to v4.x and v3.x

Co-authored-by: Silvan <[email protected]>

2026-01-12 06:44:49 +00:00

..

repository

fix(login v1): handle automatic re-auth using id_token_hint properly (#11326)

2026-01-12 06:44:49 +00:00