[OAUTH-WG] Add an option to authorization endpoint to force end-user re-authentication

[Colin Snover <[e-mail]>]

Hi everyone,

I apologise if this has been discussed previously; I searched the list 
and did not see anything about it.

I have been working extensively with OAuth as a client author. A big 
limitation that we are consistently running into with the way OAuth 
currently works is that there is no way to tell the authorization server 
that it needs to ask which end-user is requesting access.

In instances where an end-user may have more than one account on a 
single provider, or where multiple end-users share the same computer, a 
problem occurs when the provider assumes that the account currently 
logged-in in the user-agent is the one that the end-user wants to 
connect. This assumption, while useful in most cases, causes major 
problems and a very frustrating user experience when the client has 
previously been authorised for the logged-in account and the provider 
immediately redirects back with an access token. In these cases, the 
user has no ability to choose to authorize a different account unless 
they manually log out of the provider’s site first or revoke 
authorization from the provider’s site.

We need a way for the client to tell the authorization server “please do 
not automatically assume that the account currently logged-in is the 
account that we are requesting access for”. I would propose adding a new 
optional query component to the end-user authorization endpoint, 
force_auth. When this query component exists and is equal to 1, a 
provider MUST ask for the user’s credentials before either automatically 
redirecting back (if the client is already authorized) or presenting 
them with the prompt for authorization.

Thank you for your time and consideration of this matter. I hope this 
feature or something similar can make it into OAuth 2, since otherwise 
we are going to have huge headaches and may end up needing to resort to 
cross-site request forgery to force user-agents to log out of provider 
sites. If I have been unclear at all, please let me know and I will be 
happy to clarify.

Regards,

-- 
Colin Snover
http://zetafleet.com