Search code examples
openid

ReAuth flow for sensitive content in a website using openID

I would like to know if is possible to force reAuth for sensitive content on the website.

Is this possible to implement, whenever a user in the RP want to access to sensitive content, a reAuth in the OP?

Thanks for your help

Solution

  • Your RP may include prompt=login request parameter when RP redirects user to OP. See http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest