ORory
oAuth2

Accept OAuth 2.0 Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it.

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

This endpoint tells Ory that the subject has successfully authenticated and includes additional information such as the subject's ID and if Ory should remember the subject's subject agent for future authentication attempts by setting a cookie.

The response contains a redirect URL which the login provider should redirect the user-agent to.

put/admin/oauth2/auth/requests/login/accept

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /admin/oauth2/auth/requests/login/accept
  • Auth
    none declared

Query parameters

login_challengestring required

OAuth 2.0 Login Request Challenge

Request body

acrstring

ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two-factor authentication.

amrstring[]

AMR sets the Authentication Methods References value for this authentication session. You can use it to specify the method a user used to authenticate. For example, if the acr indicates a user used two-factor authentication, the amr can express they used a software-secured key.

contextJSONRawMessage
extend_session_lifespanboolean

Extend OAuth2 authentication session lifespan

If set to true, the OAuth2 authentication cookie lifespan is extended. This is for example useful if you want the user to be able to use prompt=none continuously.

This value can only be set to true if the user has an authentication, which is the case if the skip value is true.

force_subject_identifierstring

ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.

Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the sub claim in the OAuth 2.0 Introspection.

Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself you can use this field. Please note that setting this field has no effect if pairwise is not configured in ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via subject_type key in the client's configuration).

Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies that you have to compute this value on every authentication process (probably depending on the client ID or some other unique value).

If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.

identity_provider_session_idstring

IdentityProviderSessionID is the session ID of the end-user that authenticated. If specified, we will use this value to propagate the logout.

rememberboolean

Remember, if set to true, tells Ory Hydra to remember this user by telling the user agent (browser) to store a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, they will not be asked to log in again.

remember_forinteger

RememberFor sets how long the authentication should be remembered for in seconds. If set to 0, the authorization will be remembered for the duration of the browser session (using a session cookie).

subjectstring required

Subject is the user ID of the end-user that authenticated.

Response

oAuth2RedirectTo

redirect_tostring required

RedirectURL is the URL which you should redirect the user's browser to once the authentication process is completed.

Changes

No recorded changes to this operation across all 51 revisions of this API.