Implicit login for Azure AAD based accounts

There is a possibility under certain circumstances to bypass a interactive login prompt from ezeep.

Conditions

It only works in conjunction with an Azure login and the OAuth grant type authorization_code. Furthermore, an already active Azure-Session in the browser is required.

Example

For the next steps it is necessary to be familiar with the grant type authorization_code. If not, please read the articles about the OAuth Authorization code first.

When ezeep is integrated in an environment where the user already had to authenticate to Azure in the browser before, this browser session can also be used for ezeep to prevent another Azure login prompt. Thus if another application already requires an Azure login, there is no need to ask for Azure credentails a second time at ezeep login. Considering that the same browser is used. To prevent ezeep from asking the user which login provider to use, the query parameter social with the value azure is required. And in general to prevent ezeep and also azure from asking for credentials, the parameter “prompt” is set with the value “none”. There may be edge cases where a prompt cannot be prevented, such as 2 factor authentication or when a user belongs to more than one organization.

Query Attribute value description
prompt none Causes neither ezeep nor azure to display a login prompt if a user session already exists
social azure Enforces the use of the login provider azure. The user has no possibility to use another login provider.

Example request

In the first request of the authorization_code grant type, which initiate the authorization code flow, the two query parameters social and prompt must be set.

GET "https://account.ezeep.com/oauth/authorize?response_type=code&client_id=IKufRXGt1Q8YFf9xKB6zDgZi9YCyRD97jsdCQNRW&redirect_uri=https://www.ezeep.com?social=azure&prompt=none"

The result should be the authorization code redirection without further login prompt. shell https://www.ezeep.com/?code=VYK6jDDDSirrvPCoasSRUWvSbESYQ2 The usual authorization code procedure can now be carried out with the code.