diff --git a/apps/login/readme.md b/apps/login/readme.md index 6b07e30e690..c35eaf0eac6 100644 --- a/apps/login/readme.md +++ b/apps/login/readme.md @@ -83,6 +83,8 @@ If no previous condition is met we throw an error stating the user was not found > NOTE: We ignore `loginSettings.allowExternalIdp` as the information whether IDPs are available comes as response from `getActiveIdentityProviders(org?)`. If a user has a cookie for the same loginname, a new session is created regardless and overwrites the old session. The old session is not deleted from the login as for now. +> NOTE: `listAuthenticationMethodTypes()` does not consider different domains for u2f methods or passkeys. The check whether a user should be redirected to one of the pages `/passkey` or `/u2f`, should be extended to use a domain filter (https://github.com/zitadel/zitadel/issues/8615) + ### /password This page shows a password field to hydrate the current session with password as a factor. @@ -107,6 +109,8 @@ If the user has set up an additional **single** second factor, it is redirected If none of the previous conditions apply, we continue to sign in. +> NOTE: `listAuthenticationMethodTypes()` does not consider different domains for u2f methods or passkeys. The check whether a user should be redirected to one of the pages `/passkey` or `/u2f`, should be extended to use a domain filter (https://github.com/zitadel/zitadel/issues/8615) + ### /otp/[method] This page shows a code field to check an otp method. The session of the user is then hydrated with the respective factor. Supported methods are `time-based`, `sms` and `email`. @@ -154,6 +158,8 @@ Requests to the APIs made: When updating the session for the webAuthN challenge, we set `userVerificationRequirement` to `UserVerificationRequirement.REQUIRED` as this will request the webAuthN method as primary method to login. After updating the session, the user is signed in. +> NOTE: This page currently does not check whether a user contains passkeys. If this method is not available, this page should not be used. + ### /mfa/set This page loads login Settings and the authentication methods for a user and shows setup options. @@ -175,6 +181,8 @@ At the moment, U2F methods are hidden if a method is already added on the users > NOTE: The session and therefore the user factor defines which login settings are checked for available options. +> NOTE: `listAuthenticationMethodTypes()` does not consider different domains for u2f or passkeys. The check whether a user should be redirected to one of the pages `/passkey/set` or `/u2f/set`, should be extended to use a domain filter (https://github.com/zitadel/zitadel/issues/8615) + ### /passkey/set /passkey/set @@ -188,6 +196,11 @@ Requests to the APIs made: - `registerPasskeyLink()` - `verifyPasskey()` +If the loginname decides to redirect the user to this page, a button to skip appears which will sign the user in afterwards. +If a passkey is registered, we redirect the user to `/passkey` to again verify it and sign in with the new method. + +> NOTE: Redirecting the user to `/passkey` will not be required in future and the currently used session will be hydrated directly after registering. (https://github.com/zitadel/zitadel/issues/8611) + ### /otp/[method]/set ### /u2f/set diff --git a/apps/login/src/ui/RegisterPasskey.tsx b/apps/login/src/ui/RegisterPasskey.tsx index 9391e62f63e..a56c34933a1 100644 --- a/apps/login/src/ui/RegisterPasskey.tsx +++ b/apps/login/src/ui/RegisterPasskey.tsx @@ -148,12 +148,39 @@ export default function RegisterPasskey({ if (authRequestId) { params.set("authRequestId", authRequestId); params.set("sessionId", sessionId); - // params.set("altPassword", ${false}); // without setting altPassword this does not allow password - // params.set("loginName", resp.loginName); router.push("/passkey?" + params); } else { - router.push("/accounts?" + params); + continueAndLogin(); + } + } + + function continueAndLogin() { + if (authRequestId) { + const params = new URLSearchParams({ + authRequest: authRequestId, + }); + + if (sessionId) { + params.set("sessionId", sessionId); + } + + if (organization) { + params.set("organization", organization); + } + + router.push("/login?" + params); + } else { + const params = new URLSearchParams(); + + if (sessionId) { + params.append("sessionId", sessionId); + } + if (organization) { + params.append("organization", organization); + } + + router.push("/signedin?" + params); } } @@ -171,32 +198,7 @@ export default function RegisterPasskey({ type="button" variant={ButtonVariants.Secondary} onClick={() => { - if (authRequestId) { - const params = new URLSearchParams({ - authRequest: authRequestId, - }); - - if (sessionId) { - params.set("sessionId", sessionId); - } - - if (organization) { - params.set("organization", organization); - } - - router.push("/login?" + params); - } else { - const params = new URLSearchParams(); - - if (sessionId) { - params.append("sessionId", sessionId); - } - if (organization) { - params.append("organization", organization); - } - - router.push("/signedin?" + params); - } + continueAndLogin(); }} > skip