login transaction redirects to apps login route with 'iss' param such as 'https://mydomain.com/login?iss='

Last Updated: Sep 10, 2025

Overview

An authentication flow is ending with this redirection and we don't understand what's causing it:

https://customerDomain.com/login?iss=https%3A%2F%2Faccounts.daycos.com%2F

Cause

Redirecting that endpoint is expected when initiating a login from a 3rd party application (such as curl in this instance). The 'iss' param being returned is to let the client (application) know which OIDC IdP the request had been intended for. More on that spec can be found here:

https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin

Solution

This is expected behavior when attempting to login using a 3rd party app/service. Login transactions should be initiated by the RP (application) itself and not on behalf of another service.