Automatic Login
The user authentication status on CONNECT can be checked by an application by issuing a "silent" authorization request.
This allows users that already have a session with CONNECT and have previously authorized the given application, to automatically log in to the application without a new login challenge.
To implement the silent auto-login, an immediate authorization request is initiated to
CONNECT for all new sessions, adding prompt=none
in the request
parameters as in the following example:
GET https://appname.scienceconnect.io/api/oauth/authorize?
client_id=testclient
&response_type=id_token
&redirect_uri=https://www.appname.com/oidc/cbk
&scope=openid
&state=jctMTcwMWE1ZmQ2ZTQx
&nonce=7362CAEA-9CA5-4B43-9BA3
&prompt=none
Adding prompt=none
ensures that users return to the application without
seeing a CONNECT user interface. Depending on their authentication status and id_token
(or code), they either log in automatically or an error is returned to the application
immediately.