Check for an existing SSO session in the default authentication flow

[Thumimku]

Purpose

The SSO session nodes were wired into the console application's authentication flow only. Every other application, including any client created through dynamic registration, ran the default flow, whose graph went straight from start to prompt_credentials and never consulted an existing session.

That leaves the OIDC session parameters unanswerable for those applications:

• prompt=none cannot be honored, because there is no session to find. The authorization endpoint decides this against the resolved session, and a flow that never resolves one has nothing to offer it.
• id_token_hint cannot identify an already-authenticated subject.
• A request whose max_age the existing authentication still satisfies re-authenticates anyway, which also moves auth_time forward when it should have stayed put.

These are OIDC Core 3.1.2.1 behaviours, so the gap is visible to any relying party that uses them, not only to a conformance run.

Approach

Add to the default authentication flow the same two nodes the console flow already carries:

• start branches to sso_check instead of prompt_credentials.
• sso_check (SSOCheckExecutor, checkpointRef: session) continues to session on a hit and falls back to prompt_credentials on a miss.
• credentials_auth now continues to session rather than straight to authorization_check, so a fresh login is recorded as a session for later requests to reuse.

The node definitions are copied from the console flow, so both graphs now express the same SSO behaviour. No executor or service code changes: this is a flow-graph change only, wiring up executors that already exist.

The console application's flow is untouched.

Old Flow

New Flow

Measured effect

Against the OIDC conformance suite's Basic OP profile, with the default flow used by a dynamically registered client:

Module	Before	After
oidcc-prompt-none-logged-in	FAILED	PASSED
oidcc-max-age-10000	FAILED	PASSED
oidcc-id-token-hint	FAILED	PASSED

Plan total went from 32/35 to 34/35. The remaining failure is unrelated to this change and is addressed separately.

Related Issues

• N/A

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)

Summary by CodeRabbit

• Authentication
  • The default sign-in flow now checks for an existing session before requesting credentials.
  • Users with a valid session continue through the session step before authorization.
  • Users without a valid session are directed to credential prompts.
  • Successful credential authentication also continues through the session step before authorization, providing a consistent sign-in experience.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 22c1d521-fa49-4ea4-9ab3-35ef0ceb4457

📥 Commits

Reviewing files that changed from the base of the PR and between f874dfe and 905388a.

📒 Files selected for processing (1)

• backend/cmd/server/bootstrap/01-default-resources.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The default authentication flow now checks the session through sso_check. Successful SSO checks and credential authentication continue through session before authorization. Layout metadata is updated for the changed flow.

Changes

Default authentication flow

Layer / File(s)	Summary
Authentication routing and session handling backend/cmd/server/bootstrap/01-default-resources.yaml	The start node routes to sso_check. SSOCheckExecutor checks the session checkpoint and routes success to session or failure to prompt_credentials. SessionExecutor leads to authorization. Credential authentication also routes through session. Node layout positions are updated.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Start
  participant SSOCheckExecutor
  participant CredentialsAuthExecutor
  participant SessionExecutor
  participant Authorization
  Start->>SSOCheckExecutor: Check session checkpoint
  alt Session check succeeds
    SSOCheckExecutor->>SessionExecutor: Route to session
  else Session check fails
    SSOCheckExecutor->>CredentialsAuthExecutor: Route to credential prompts
    CredentialsAuthExecutor->>SessionExecutor: Route successful authentication to session
  end
  SessionExecutor->>Authorization: Continue to authorization

Loading

Suggested reviewers: indeewari

Merge Risk: ⚪ Minimal · up to 3ae7b

The default authentication flow now routes existing and newly created sessions through the shared session path without an identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding an existing SSO session check to the default authentication flow.
Description check	✅ Passed	The description includes the purpose, implementation approach, flow changes, measured effect, related issue and PR sections, and checklist status. The Security checks section from the template is miss…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!