Difference between revisions of "User Consent"
From MgmtWiki
(→Context) |
|||
| Line 2: | Line 2: | ||
==Context== | ==Context== | ||
| − | *During an authorization request, | + | *During an authorization request by a Relying Party, the [[Identifier or Attribute Provider]] requires user consent redirecting the user to the consent page. |
*Consent is used to allow an end user to grant a client access to resources (identity or API). This is typically only necessary for third-party clients, and can be enabled/disabled per-client on the client settings. | *Consent is used to allow an end user to grant a client access to resources (identity or API). This is typically only necessary for third-party clients, and can be enabled/disabled per-client on the client settings. | ||
Revision as of 11:27, 29 July 2018
Full Title or Meme
Context
- During an authorization request by a Relying Party, the Identifier or Attribute Provider requires user consent redirecting the user to the consent page.
- Consent is used to allow an end user to grant a client access to resources (identity or API). This is typically only necessary for third-party clients, and can be enabled/disabled per-client on the client settings.
Solution
Consent Page
In order for the user to grant consent, a consent page must be provided by the hosting application. The quickstart UI has a basic implementation of a consent page.
- A consent page normally renders the display name of the current user, the display name of the client requesting access, the logo of the client, a link for more information about the client, and the list of resources the client is requesting access to. It’s also common to allow the user to indicate that their consent should be “remembered” so they are not prompted again in the future for the same client.
- Once the user has provided consent, the consent page must inform IdentityServer of the consent, and then the browser must be redirected back to the authorization endpoint.
