Okta OIDC Authorization Calls Using Prompt=Login Cause Re-Authentication From Scratch
Last Updated:
Overview
Including the prompt=login parameter in Okta OpenID Connect (OIDC) authorization calls forces users to re-authenticate from scratch. This occurs because the parameter intentionally ignores existing sessions and triggers the evaluation of both the Global Session Policy and the Authentication Policy. To prevent this behavior, remove the prompt=login parameter from the authorization request.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- Global Session Policy
- Authentication Policy / App Sign-in Policy
Cause
The OpenID Connect (OIDC) specification dictates that the prompt=login parameter forces the authorization server to prompt the user for authentication. When an application includes this parameter in the authorization request, Okta ignores any existing active sessions and evaluates both the Global Session Policy and the Authentication Policy (or App Sign-in Policy) as if it were a completely new login attempt.
Solution
Why does the prompt=login parameter force re-authentication?
This is the expected behavior when an application sends the prompt=login parameter in an OpenID Connect (OIDC) authorization request. The parameter specifically forces a fresh authentication flow, regardless of whether an active session already exists.
To allow users to leverage their existing active sessions without requiring re-authentication, remove the prompt=login parameter from the OIDC authorization call.
