{"action":"created","issue":{"url":"https://api.github.com/repos/anvilresearch/connect/issues/310","labels_url":"https://api.github.com/repos/anvilresearch/connect/issues/310/labels{/name}","comments_url":"https://api.github.com/repos/anvilresearch/connect/issues/310/comments","events_url":"https://api.github.com/repos/anvilresearch/connect/issues/310/events","html_url":"https://github.com/anvilresearch/connect/issues/310","id":126255358,"number":310,"title":"Initiating Login from a Third Party","user":{"login":"christiansmith","id":332377,"avatar_url":"https://avatars.githubusercontent.com/u/332377?v=3","gravatar_id":"","url":"https://api.github.com/users/christiansmith","html_url":"https://github.com/christiansmith","followers_url":"https://api.github.com/users/christiansmith/followers","following_url":"https://api.github.com/users/christiansmith/following{/other_user}","gists_url":"https://api.github.com/users/christiansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/christiansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christiansmith/subscriptions","organizations_url":"https://api.github.com/users/christiansmith/orgs","repos_url":"https://api.github.com/users/christiansmith/repos","events_url":"https://api.github.com/users/christiansmith/events{/privacy}","received_events_url":"https://api.github.com/users/christiansmith/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/anvilresearch/connect/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/anvilresearch/connect/labels/needs%20investigation","name":"needs investigation","color":"fef2c0"},{"url":"https://api.github.com/repos/anvilresearch/connect/labels/p2","name":"p2","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/anvilresearch/connect/milestones/1","html_url":"https://github.com/anvilresearch/connect/milestones/Core%20OIDC%20Interoperability","labels_url":"https://api.github.com/repos/anvilresearch/connect/milestones/1/labels","id":684727,"number":1,"title":"Core OIDC Interoperability","description":"","creator":{"login":"christiansmith","id":332377,"avatar_url":"https://avatars.githubusercontent.com/u/332377?v=3","gravatar_id":"","url":"https://api.github.com/users/christiansmith","html_url":"https://github.com/christiansmith","followers_url":"https://api.github.com/users/christiansmith/followers","following_url":"https://api.github.com/users/christiansmith/following{/other_user}","gists_url":"https://api.github.com/users/christiansmith/gists{/gist_id}","starred_url":"https://api.github.com/users/christiansmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christiansmith/subscriptions","organizations_url":"https://api.github.com/users/christiansmith/orgs","repos_url":"https://api.github.com/users/christiansmith/repos","events_url":"https://api.github.com/users/christiansmith/events{/privacy}","received_events_url":"https://api.github.com/users/christiansmith/received_events","type":"User","site_admin":false},"open_issues":15,"closed_issues":10,"state":"open","created_at":"2014-06-08T22:31:33Z","updated_at":"2016-01-12T19:25:35Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2016-01-12T19:25:35Z","updated_at":"2016-01-14T20:40:16Z","closed_at":null,"body":"> In some cases, the login flow is initiated by an OpenID Provider or another party, rather than the Relying Party. In this case, the initiator redirects to the RP at its login initiation endpoint, which requests that the RP send an Authentication Request to a specified OP. This login initiation endpoint can be a deep link at the RP, rather than a default landing page. RPs supporting OpenID Connect Dynamic Client Registration 1.0 [OpenID.Registration] register this endpoint value using the initiate_login_uri Registration parameter.\r\n\r\n> The party initiating the login request does so by redirecting to the login initiation endpoint at the RP, passing the following parameters:\r\n\r\n>>  iss\r\n>>>  REQUIRED. Issuer Identifier for the OP that the RP is to send the Authentication Request to. Its value MUST be a URL using the https scheme.\r\n\r\n>> login_hint\r\n>>> OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in. If the client receives a value for this string-valued parameter, it MUST include it in the Authentication Request as the login_hint parameter value.\r\n\r\n>> target_link_uri\r\n>>> OPTIONAL. URL that the RP is requested to redirect to after authentication. RPs MUST verify the value of the target_link_uri to prevent being used as an open redirector to external sites.\r\n\r\n> The parameters can either be passed as query parameters using the HTTP GET method or be passed as HTML form values that are auto-submitted in the User Agent, and thus are transmitted via the HTTP POST method.\r\n\r\n> Other parameters MAY be sent, if defined by extensions. Any parameters used that are not understood MUST be ignored by the Client.\r\n\r\n> Clients SHOULD employ frame busting and other techniques to prevent End-Users from being logged in by third party sites without their knowledge through attacks such as Clickjacking. Refer to Section 4.4.1.9 of [RFC6819] for more details.\r\n\r\nhttp://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin"},"comment":{"url":"https://api.github.com/repos/anvilresearch/connect/issues/comments/171773108","html_url":"https://github.com/anvilresearch/connect/issues/310#issuecomment-171773108","issue_url":"https://api.github.com/repos/anvilresearch/connect/issues/310","id":171773108,"user":{"login":"amolojo","id":16667358,"avatar_url":"https://avatars.githubusercontent.com/u/16667358?v=3","gravatar_id":"","url":"https://api.github.com/users/amolojo","html_url":"https://github.com/amolojo","followers_url":"https://api.github.com/users/amolojo/followers","following_url":"https://api.github.com/users/amolojo/following{/other_user}","gists_url":"https://api.github.com/users/amolojo/gists{/gist_id}","starred_url":"https://api.github.com/users/amolojo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amolojo/subscriptions","organizations_url":"https://api.github.com/users/amolojo/orgs","repos_url":"https://api.github.com/users/amolojo/repos","events_url":"https://api.github.com/users/amolojo/events{/privacy}","received_events_url":"https://api.github.com/users/amolojo/received_events","type":"User","site_admin":false},"created_at":"2016-01-14T20:40:16Z","updated_at":"2016-01-14T20:40:16Z","body":"And of course, this has no consequences when IdPs are chained within the same secuity realm. E.g a global intranet with several local IdPs, or a federation of intranets through secure links."}}