ATO-2107: Handle single factor account deletion journey in auth callback (part 1) #7504
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cearl1
changed the title
Louisasa
reviewed
Nov 20, 2025
| attachLogFieldToLogs(CLIENT_ID, clientId); | ||
|
|
||
| // Validation | ||
| boolean reauthRequested = |
Contributor
There was a problem hiding this comment.
can I ask why you added the validation comment? just because we haven't done that elsewhere and there is more validation throughout this method
Contributor
Author
There was a problem hiding this comment.
Oops, that was just a placeholder while I was figuring out the handler. I'll remove that!
| auditService.submitAuditEvent( | ||
| OrchestrationAuditableEvent.AUTH_CALLBACK_RESPONSE_RECEIVED, clientId, user); | ||
| var errorCode = input.getQueryStringParameters().get("error"); | ||
| if (configurationService.isSingleFactorAccountDeletionEnabled() |
Contributor
There was a problem hiding this comment.
can we add a log somewhere in this if to say new sessions etc have been generated?
Contributor
Author
There was a problem hiding this comment.
Good shout, the logging is a bit sparse. I've added a bunch more!
cearl1
force-pushed
the
ATO-2107/handle-oauth-error-in-auth-callback
branch
from
8217098 to
32a191b
Compare
- SFAD = Single Factor Account Deletion - If we are on a reauth journey and get an SFAD error, we want to redirect to the auth error page. - Error code is subject to change
cearl1
force-pushed
the
ATO-2107/handle-oauth-error-in-auth-callback
branch
from
32a191b to
474f394
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Wider context of change
We would like to handle a journey where a user can delete their account if they do not have access to their MFA methods. From an orch perspective this involves waiting for a specific error from auth in the AuthenticationCallbackHandler, generating a new session and client session, and redirecting back to auth to start a new journey. We have split this work into 2 major parts, the first being creating a new feature flag, handling the single factor account deletion (SFAD) error from auth, and generating new sessions. The second part would be to redirect to auth to start a new journey..
What’s changed
This PR is the first part of the single factor account deletion changes. It adds a feature flag for SFAD enabled (only in dev at the moment), checks to see if there is an oauth error from auth (Note: we are using a placeholder error for the time being), and generates a new session and client session if the feature flag is enabled and the error is present.
If the user is on a reauth journey they will be redirected to the auth frontend error page, as this will not be supported in the new SFAD journey.
At the moment, the successful SFAD journey ends by redirecting to the frontend error page, and updating the new session cookies. This will be changed in a later issue.
Manual Testing
Tested an auth journey in dev which completed successfully.
Checklist