Okta Sign-In Widget Pre-Populates the Username When the Login Hint Parameter is Passed
Last Updated:
Overview
When an /authorize call contains the login_hint parameter, the Okta Sign-In Widget pre-populates the username field. This occurs because the Service Provider (SP) sends a login hint, such as an email address, which may differ from the intended Okta username. Okta complies with the OAuth specification by respecting the login_hint parameter and displaying it in the widget.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Service Provider (SP) Initiated Login
- Okta Sign-In Widget
- OpenID Connect/OAuth 2.0 application
Cause
The login hint sent by the Service Provider may differ from the username that Okta requires for authentication.
For example, the Service Provider sends an email address as the login hint, causing the Okta Sign-In Widget to pre-populate the email address instead of the expected username identifier.
Solution
Why does the Okta Sign-In Widget pre-populate the username?
Okta complies with the OpenID Connect specification, see section 3.1.2.1. The Okta API respects the login_hint parameter included in the authorize call and instructs the browser to display the provided value as the username in the Okta Sign-In Widget.
