Re-Authenticate User before sensitive operations w/ classic login

Help
, ,
1

I’m trying to re-authenticate a user before they do a sensitive operation (e.g. viewing sensitive data). They are already logged in at this point.

I’ve read the answers here and here.

I have a Rails app using the instructions in the Rails quick start guide. I’ve tried adding prompt: 'login' and/or max_age: 60 to the authorize_params as shown here and neither seem to do anything.

When I try to make a user re-authenticate the two calls get called back to back:

  1. POST “/auth/auth0”
  2. GET “/auth/auth0/callback”

I’d expect the POST request to bring up the universal login page, and then once the user successfully logs in the GET request would be called. But somehow it knows the user is already logged in and just skips the whole process.

I will note that when I use the New Universal Login, it works correctly (I can force the user to reauthenticate without logging them out first). But when I use the Classic Universal Login experience it doesn’t work at all (I am using the Lock.js implementation). I have to use the Classic login for other reasons, so wanted to confirm that things like prompt=login are supposed to work for Classic?

What would be the correct way to force a user to re-authenticate assuming I am using a Rails app with the Classic Universal login?

Edit: I want to add that I don’t think the POST “/auth/auth0” call makes it to the classic login at all (I have console logging in the classic lock.js widget and nothing appears). It seems to completely skip the universal login experience. Perhaps there is an application setting that I have to change?

1 Like
2

Any word on this? Did this ever work with the classic universal login?

3

It’s been a while so I can’t remember 100%. But I believe I got it to work by changing some of the Application settings in the Auth0 UI.

Under the Application settings, there is one setting called “Use Auth0 instead of the IdP to do Single Sign On”. I had to turn this OFF in order to avoid the endless re-authentication loop. Note: In order to turn this off, I think I had to first turn off “OIDC Conformant” setting under Advanced Settings → Oauth. I’m not sure on the ramifications of this, or if you’ll be able to do this in your app.

1 Like