feat: support passing login query string to oauth authorize redirect #2222
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This commit modifies the
AuthOAuthView
login function, introducing the option to preserve inbound request parameters and include them on the authorize redirect url created by the OAuth provider. This functionally is controlled by a new configuration boolAUTH_OAUTH_PRESERVE_LOGIN_QUERY
. This value defaults to false to ensure this change is opt-in only and should have no impact on current usage.This feature is needed to better support login via a federated IdPs (e.g., Cognito with multiple federated providers). For example, consider the following flask endpoints:
With this commit, the resulting redirects will be (some parameters excluded for readability):
Note the
identity_provider
parameter on each authorize url. This will allow Cognito (or other OAuth2 providers) to immediately redirect the client to the applicable IdP, improving overall user experience.ADDITIONAL INFORMATION