Auto-login when clicking Reply link in email#207

Hey everyone,

this might be an edge-case, but SSO has many different use-cases so I wanted to check on what’s possible.

Our scenario: App (Android + iOS) in which we have embedded a WebView with a private Nolt board (private since only our customers should be able to see and interact). The users which are logged into our app are automatically logged into Nolt via SSO so we know who posted what etc.

So far, so good. Now we come to the challenge: If the users have been given an e-mail via Nolt-SSO, they will receive E-Mail Updates as soon as I interact with a feedback of theirs. Now they will receive an e-mail but are unable to interact with the post on their device, since they are not automatically logged in via SSO outside of the app.

This makes it really hard for us to receive a second level of interaction or a conversation going. Is there some way so links in e-mails to SSO-signed users can be opened on any device so the users is (at least temporarily) logged in as well?

I hope I was able to make a clear case here, please follow-up with any questions :D

Thanks a lot for bringing this up and your detailed explanation, Daniel. An approach could be for us to redirect the unauthenticated user to the SSO Remote Login URL (https://nolt.io/help/single-sign-on) instead of showing a 404 when someone opens a private post directly (the same flow as if someone opens the start page of a private board):

1. The user gets an email notification
2. The user clicks on the Reply link
3. Redirect the user to your SSO Remote Login URL when not logged in
4. You authenticate the user, generate a JWT, and redirect back the user to Nolt

If someone is already logged in to your site, no further interaction is required for the user to authenticate himself. Guests, on the other hand, will see your login form, have to enter their credentials, and will then be redirected back to your Nolt board.

Introducing Signed URLs, which automatically authenticate users, would be UX-wise definitely a less distracting flow, but the implementation is a bit more challenging. Because it reduces the complexity for end-users, I certainly think it’s something we should look into, even if it requires more work from our side.

In my opinion, both approaches from this ticket should be tackled, as the first one is more of a bug.

Thanks again!

I’d like it, if the user would have an option to just sign in to Nolt, with the email-address, he/she used to authenticate with our service and then to recieve the signin-code as usual. If you do this currently, no board is shown, even when the user’s email has been used in a SSO login. I’d like it, if the user would see all the boards, where he/she had been signed in via SSO at least once. This would enable us with basically no effort to enable our users to collaborate via Nolt, without building a dedicated login for Nolt. It would also, more or less, solve the issue described above.

Thanks for writing in, Philipp! Imagine the following scenario: Somebody creates a board and enables SSO. The same person authenticates an SSO user with your email address. Wouldn’t SSO users be scoped to a board, and thus having a separate account behind the scenes, that person could easily hijack your Nolt account just by using your email address in the SSO JWT payload in their board. That’s the reason why, with reasonable best efforts, it’s not possible to connect the SSO user-generated content with a “real” Nolt account. I hope this makes sense, but please let me know if you have any follow-up questions!

When an unauthenticated user opens a private board post, a login form is now shown instead of a 404. If a Remote Login URL is set, the user will be redirected to that URL. This change fixes the flow for SSO users and regular members in private boards.

Although this should be enough, I will keep this ticket open until Signed URLs in notification emails are in action (logged-out user clicks on the link in a notification email and is automatically logged-in).