Repository navigation
feat(ui,clerk-js,shared,localizations): Offer enterprise SSO in the reverification modal - #10346
Draft
mauricioabreu wants to merge 4 commits into
Draft
mauricioabreu wants to merge 4 commits into
mauricioabreu wants to merge 4 commits into
Conversation
…everification modal The modal dropped enterprise_sso from the supported first factors, so a user whose only factor is an identity provider got "no available methods". It now shows a button per enterprise connection, runs the IdP round trip in a popup that reports back through the Account Portal popup callback, and falls back to a full-page redirect when the popup is blocked.
🦋 Changeset detectedLatest commit: f0df639 The changes in this PR will be included in the next version bump. This PR includes changesets to release 23 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
…rification Without it, a user who picks their enterprise connection in the reverification modal gets an error instead of being sent to the identity provider, because FAPI rejects the prepare call. Resolve the email address from the enterprise account tied to the chosen connection, fall back to the primary email, and close the popup when the prepare call fails. Part of ORGS-1939
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-biometrics
@clerk/expo-google-signin
@clerk/expo-native-components
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/mosaic
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
…rise SSO reverification Some apps cannot or do not want to open a popup for the identity provider round trip, and today the modal only falls back to a redirect when the browser blocks the popup. `oauthFlow` on `useReverification` and on the reverification modal props now accepts 'popup' (the default), 'redirect' or 'auto', the same values the sign-in component takes. With 'redirect' the modal sends the page to the IdP and the user comes back verified. Part of ORGS-1939
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Reverification asks a signed-in user to prove it is still them before a sensitive action. For a user who signed in through enterprise SSO, the Frontend API lists
enterprise_ssoamong the supported first factors, but the prebuilt modal in@clerk/uifilters that strategy out. A user with no password, phone or email code gets "Cannot verify your account" and is stuck. OpenRouter hit this with SAML and OIDC users.Why
The SDK already supports the flow:
session.prepareFirstFactorVerification({ strategy: 'enterprise_sso' })returns the identity provider URL, and custom UIs can use it today. Only the modal was missing. The round trip runs in a popup becauseuseReverificationkeeps the pending action in memory; a full-page redirect would verify the user but drop the action they were trying to perform. The popup reuses the Account Portal/popup-callbackpage that OAuth sign-in popups already rely on.How
Expand
enterprise_ssojoins the modal's supported first factors. An SSO-only user lands on a card with one button per enterprise connection (reusingChooseEnterpriseConnectionCard); a user with a password sees "Continue with <connection>" under "Use another method".prepareFirstFactorVerificationwithredirect_urlandaction_complete_redirect_urlpointing at the Account Portal popup callback, and navigates the popup to the IdP URL. When the callback posts back, the modal refreshes the session token and resolvesafterVerification, so the original action resumes without a reload. For amulti_factorlevel it moves on to the second factor instead.oauthFlow: 'redirect'onuseReverificationor on the modal props;'auto'follows the sign-in heuristic and'popup'stays the default.Session.prepareFirstFactorVerificationnow forwardsactionCompleteRedirectUrlforenterprise_sso, and the prepare params type accepts it as optional.reverification.enterpriseSSO.{title,subtitle}andreverification.alternativeMethods.blockButton__enterpriseSSO. Other locales regenerated in a separate commit.Known limitation: the Account Portal callback posts the same message whether the IdP round trip succeeded or failed, so a failed round trip resolves the modal and the retried action asks for reverification again.
Testing
Expand
UVFactorOne.test.tsx: SSO-only user sees the connection button; two connections give two buttons; password plus SSO lists SSO under "Use another method"; blocked popup falls back to a redirect with the prepare params; popup callback message completes the verification.pnpm --filter @clerk/ui testfor UserVerification and SignIn, lint and format forui,shared,clerk-js,localizations.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Part of ORGS-1939