[flyer5200]

Changelog category

• New Feature

Changelog entry

• Allow clients to choose an OIDC identity source and redirect users directly to its sign-in page.

Affected version

• 2026.5.0

Background

Applications using an existing OIDC identity provider often want to send users directly to that provider, without asking them to choose a sign-in method on the GrantForge login page. OAuth clients need to express that choice in their authorization request.

Implementation

• Accept an identity source code through the login page’s provider query parameter, or through provider in the local /oauth2/authorize request. An explicit login-page parameter takes precedence.
• Reuse the existing federated sign-in endpoint and preserve the complete authorization request, including state, nonce, and PKCE.
• Validate provider codes, reject ambiguous or invalid nested parameters, and retain the normal error and two-step verification flows.
• Document direct login and OAuth client usage in English and Chinese.

Validation

• Authentication view and authorization utility tests: 21 passed.
• Frontend production build and lint passed.