Login

The login journey (journey IDs login and saml_idp_login) signs a user in to an application. It starts with an OAuth 2.0 / OpenID Connect authorization request of the application and ends with a token or authorization code for the application.

How login works

Most steps run only when needed. Whether MFA, a password change or a consent is required depends on the verification options and authorization settings of the application and on the user.

Injection points

Injection point	Position	Typical use
after_login	right after the user signed in	Fraud or eligibility check against your systems
after_precheck_eval	after cidaas evaluated its checks	Contractual checks, e.g. is the contract active
after_auth_before_mfa	before multi-factor authentication	Your own risk signal: require MFA
after_consent_before_token	after the consents, before group selection	An additional business consent
pre_token_issue	immediately before the token is issued	Partner consent, a value for the token

Your tasks can require more (for example MFA), but they cannot skip a step that cidaas requires.

Context variables

Variable	Type	Meaning	Write
sub	string	User ID. Available after the user signed in.	no
client_id	string	Application that started the login	no
client_type	string	Client type of the application	no
identifier	string	Identifier the user entered. Personal data.	no
usernameType	string	Kind of identifier, e.g. email or mobile number	no
provider	string	Own credentials or the social / enterprise provider used	no
amr_values	array of string	Authentication methods completed (see AMR values)	no
lastAuthTime	timestamp	Time of the last authentication in this login	no
verificationMethodUsed	string	Verification method used in the last authentication step	no
verificationMedium	string	Medium used for verification	no
verificationCompleted	boolean	Email or mobile number verification completed	no
scopes	array of string	Scopes requested by the application	no
acr_values	string	Requested authentication context class	no
authorization_details	array of object	Requested Rich Authorization Request details	no
prompt	string	OIDC prompt parameter	no
acceptLanguage	string	Language preferences of the browser	no
rememberMe	boolean	The user chose “remember me”	restrict only — true → false
smartMfaRequired	boolean	MFA is required based on the risk evaluation	restrict only — false → true
groupVerificationResult	object	Result of the group / role check (verified)	no
selectedGroupId, selectedGroupType	string	Group the user selected	no
c_*	any	Your own variables	yes

Example: Partner consent before the token

A bank wants the user to confirm that account data may be shared with a partner service, but only if this consent is still missing. The consent ID must be in the token.

Injection point	Task	Configuration
pre_token_issue	automated, Web API consent-required	Input: sub. Output: c_consentRequired
pre_token_issue	interactive task partner_consent, page c_partner_consent	Pre condition ctx.c_consentRequired == true. The page shows the consent text and sends the decision to the Web API consent-create via cidaas.
—	completion by the bank's API	After consent-create, the bank's API completes the step with the consent ID. Output: c_consentId — set by the bank's system, not by the page.
—	claim mapping	c_consentId is mapped into a token claim

MFA and all other checks of cidaas have already run when the consent page appears.

Next steps

• Custom tasks: register your Web APIs and custom pages
• Journey model: conditions and input and output mapping

Need Support?

Please contact us directly on our support page or reach out to cidaas support at [email protected].