Disable the login_hint Parameter that is Passed by Default to the IdP

Some Identity Providers (IdPs) do not use email for login. Instead, they use some other username. With the current out-of-the-box behavior, the email address entered by the user into the Auth0 login page (with Home Realm Discovery) is automatically set as the Identifier in the Identity Provider's login form. This results in the user taking extra steps to change the Identifier or getting an error when attempting to log in.

• login_hint Parameter
• login_email Parameter
• Identity Providers (IdP)
• Home Realm Discovery (HRD)
• OpenID Connect (OIDC)

Auth0 passes the login_hint parameter to the upstream OpenID Connect (OIDC) provider, and this cannot currently be changed. However, it is possible to display the OIDC connections as a button (instead of the user entering their email). This parameter will not be sent. 

Another option to prevent login_hint from being passed to the IdP is by aliasing it to another parameter name, as explained with an example in Pass Parameters to Identity Providers.

This can be achieved by following the below steps:

1. Identify the connection for which login_hint should not be passed as per the business use case.

2. Make a call to the Auth0 Management API to get the connection options.

   curl --request GET \
   --url 'https://DOMAIN/api/v2/connections/CONNECTION-ID?fields=options&include_fields=true' \
   --header 'authorization: Bearer ACCESS_TOKEN' \
   --header 'content-type: application/json'

3. Update the connection options object to include an upstream_params object that sets an alias for login_hint.
   NOTE: The full options object must be passed, as the PATCH will replace the existing options object with what is sent.

   {
     "options": {
       ...all the other options from step 2...
       "upstream_params": {
         "login_email": {
           "alias: "login_hint"
         }
       }
     }
   }

4. Make a call to the Auth0 Management API to patch the connection options.

   curl --request PATCH \
   --url 'https://DOMAIN/api/v2/connections/CONNECTION-ID' \
   --header 'authorization: Bearer ACCESS_TOKEN' \
   --header 'content-type: application/json' \
   --data '{"options": { ...all options from step 3... }}'

This will result in the login_hint value being passed in the login_email parameter instead, and therefore, the login_hint parameter will not be sent to the IdP.

The caveat with this approach is that it still sends a parameter. It should be set to something the IdP will ignore.