Authorize always redirects to LoginURL even when auth request is already authenticated (SSO/session use-case)

[mohammadlashkari]

Hi,
I’m implementing a custom OIDC provider using github.com/zitadel/oidc/v3 and adding session-based SSO (browser login sessions).

In my implementation, when a user already has a valid session, I mark the auth request as authenticated inside Storage.CreateAuthRequest however the Authorize handler always does:

req, _ := authorizer.Storage().CreateAuthRequest(...)
RedirectToLogin(req.GetID(), client, w, r)

This causes a redirect to the login UI even when the user already has a valid session and the auth request is already authenticated

Questions

1. When a valid session already exists, should the flow be short-circuited inside Storage.CreateAuthRequest, or is it only expected to mark the request as authenticated and let the caller handle redirection?

2. Should the Authorize handler detect an already authenticated auth request and redirect directly to the callback instead of always redirecting to the login UI?

3. Is there a recommended pattern for handling sessions and SSO?

Any guidance or documentation pointers would be appreciated. Thanks!

[mohammadlashkari]

I’d really appreciate it if someone could guide me on this.