Skip to content

[Feature Request] Support for idp parameter in initiate_auth_code_flow() for Microsoft Entra ID External ID #842

Description

@piotrstempkowski

MSAL client type

Public

Problem Statement

Describe the feature request

Microsoft Entra ID External ID with Google federation shows an email
input screen despite using domain_hint=google.com. The idp parameter
could bypass this screen for direct Google redirect, but MSAL Python
doesn't support it.

Goal: Enable direct redirect to Google OAuth without Microsoft email
input screen.

Current behavior

import msal

app = msal.PublicClientApplication(
    client_id="your-client-id",
    authority="https://tenant.ciamlogin.com/tenant-id"
)

flow = app.initiate_auth_code_flow(
    scopes=["User.Read"],
    redirect_uri="http://localhost:8000/callback",
    domain_hint="google.com",
    idp="Google"  #  TypeError: unexpected keyword argument 'idp'
)

Generated URL:
https://tenant.ciamlogin.com/.../authorize?...&domain_hint=google.com&..
.

Expected behavior

Support for idp parameter to enable direct Google redirect:

flow = app.initiate_auth_code_flow(
    scopes=["User.Read"],
    redirect_uri="http://localhost:8000/callback",
    domain_hint="google.com",
    idp="Google"  #  Should work for direct redirect
)

Expected URL:
https://tenant.ciamlogin.com/.../authorize?...&domain_hint=google.com&id
p=Google&...

User experience impact

- Current UX: User clicks "Login with Google"Microsoft shows email
inputuser enters emailredirect to Google
- Expected UX: User clicks "Login with Google"direct redirect to
Google OAuth (no email input)

Current workaround

flow = app.initiate_auth_code_flow(scopes, redirect_uri,
domain_hint="google.com")
flow["auth_uri"] += "&idp=Google"  also tried with kwargs

MSAL Python version

python -c "import msal; print(msal.__version__)"
# 1.32.3

Environment

- Microsoft Entra ID: External ID (CIAM)
- Identity Provider: Google OAuth federation
- Use Case: FastAPI authentication API

Additional context

The idp parameter is documented in https://docs.microsoft.com/en-us/azur
e/active-directory/develop/v2-oauth2-auth-code-flow and would improve
user experience for federated authentication scenarios.

https://learn.microsoft.com/en-us/answers/questions/2279262/how-can-i-configure-microsoft-entra-external-id-to

### Proposed solution

_No response_

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions