Identityserver4: Add ability to do authentication request without setting or overwriting the current authentication cookie

[leastprivilege]

be able to authenticate a user without setting an authentication cookie - or without overwriting an existing authentication cookie.

scenario 1: create tokens without creating authentication session
scenario 2: "identify only" - user is already signed id, but needs to elevate privileges, impersonate different user or approval scenario.

Could be limited to id_token or id_token token scenarios.

[dodegaard]

Does it look like this feature will make it to RTM? Saw that it switched from RC4 to RTM. Wondering if you have had time to assess if it is possible to do. Thanks so much for your work, guys.

[brockallen]

we will ensure that it's possible. this might mean custom code on your part (via our extensibility points).

[dodegaard]

From the looks of the dev branch it looks like you guys are close to RTM. I simply wanted to check back in on this issue and if I can plan on using RTM for this as noted by the updated milestones along the way. I'm good with examples/guidance on "custom code" as noted by Brock above but need to assure the ability to use IdSvr4 for my solution. Thanks guys. Amazing work.

[brockallen]

We've concluded that this is possible with no modifications to the current code base.

[dodegaard]

Brock....how is it possible to not have a cookie when using ASP.NET Identity along with IdSvr? Thinking on this I needed to ask more of how to achieve that which was my original request. Thanks.

[leastprivilege]

We will add more documentation ASAP.

Completely cookieless is not possible right now. For now you can use a really short lived cookie. We also added more extensibility points that allow you to delete the cookie once the authorize request is done.

[roly445]

Have you had a chance to write some doumentation for this @leastprivilege, or do you have some code examples to share for this?

[gartak]

I'm interested to use localstorage instead of cookie, too.
There's some documentation about this feature?

[agnimitra]

Hi Guys, is there any documentation available for this now. Can anyone please redirect me to the docs.

[paulcsiki]

I'm also interested in a way to authenticate using JWTs instead of cookies.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.