By: ved singh user 18 Aug 2017 at 8:36 p.m. CDT

3 Responses
ved singh gravatar
Hi, I was wondering whether it is possible to have multiple login page configured in Gluu. We have a scenario where 2 Service Provider(SP) is having a TR with Gluu IDP. Both these SP website wants to have their specific branding/styling in login page. I'm able to customize(re - skin) the login page with one brand style but how do i do it for the other. Is there a way i can pass a parameter which i can use in the login page for styling decision or can i have more than one login page. Any guidance/insights would be helpful. Thanks

By Aliaksandr Samuseu staff 18 Aug 2017 at 9:18 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Ved. It's impossible in 3.0.2 for SAML flows, as far as I know. For OIDC you have option to pass `acr_values` url query parameter which in case of Gluu should contain name of custom script implementing auth method you need. In case of SAML flows default oxAuth auth method will always be used, and no parameters are passed to it which would allow to select some particular script. In CE 3.1 there should be a new feature which allows you to pass `entityid` of SP requestor to that default auth method. We also have a basic script which can "route" authentication flow to other custom scripts, based on some condition, which you could customize. So combining those 2 features, you may be able to select a proper auth method based on `entityid` of SP. No ETA for this feature at the moment, though.

By ved singh user 18 Aug 2017 at 9:53 p.m. CDT

ved singh gravatar
Thanks Aliaksandr. This was helpful.

By Michael Schwartz Account Admin 19 Aug 2017 at 4:20 p.m. CDT

Michael Schwartz gravatar
Alex is right that OpenID Connect would give you more flexibility to specify a specific custom script during authentication (at which time you could us the getPageForStep method of the interception script to display a different page. However... if the user already has a session, when navigating to the 2nd page, no login page is display (i.e. there is SSO). This could be a use case for UMA. If you use an UMA RPT access token, as part of the "claims gathering" flow, it might give you even more flexibility to route to a different authentication workflow, depending on the context.