Trying to discover the appropriate path in an OpenID Connect/OAuth 2 environment to have what amounts to a second user in the same app to approve an option.
Use Case: Cashier is logged into web-based sales app at a register, and would like to change a price on an item. The price change requires a manager to approve the change. Would like to open a new dialog, have the manager sign in and click the “approve” button (same app, same computer, etc.)
What does this flow look like application-wise?
For your use case, just use two code flows, the first to sign the cashier in and the second to sign the manager in. The second OpenID Connect redirect might use parameters like these, with prompt to force a new login and login_hint to autofill the user name (if you could work out the logic to do that):
GET /oauth/authorize
Host: login.example.com
client_id=myclient&
redirect_uri=http://www.example.com/callback&
response_type=code&
scope=openid profile sales&
code_challenge=WhmRaP18B9z2zkYcIlb4uVcZzjLqcZsaBQJf5akUxsA&
code_challenge_method=S256&
state=CfDJ8NxaYhPzjpBilDQz2C&
prompt=login&
[email protected]
RELATED FLOWS
-
One related flow is Client-Initiated Backchannel Authentication (CIBA), where the manager could run their own app remotely.
-
Another related solution is to use impersonation, where the authorization server enables a code flow to prompt the main user for another user to impersonate, and then issues an extra claim to access tokens, such as
act_as.