Support custom redirect URL after authentication when using skip_pref_login

Summary

Introduce a new parameter used in conjunction with the skip_pref_login flag on the login.jsp authentication URL that allows callers to specify a post‑authentication redirect URL.

This enhancement would allow users who bypass the preferred login method to be redirected to an authorized application endpoint instead of the default common-nav landing page, which many users (particularly test LDAP users) are not permitted to access.

Problem Description

In deployments where multiple identity sources are configured, users may need to authenticate with a non‑preferred identity provider. The skip_pref_login=true parameter currently makes this possible by exposing the login page and allowing the user to select an alternative authentication method (such as LDAP).

However, after successful authentication, the system unconditionally redirects the user to the default common-nav endpoint. Many users, especially limited-scope test users, do not have permission to access this endpoint and immediately encounter a 403 Unauthorized error.

This behavior creates a poor user experience and requires manual workarounds to navigate to the correct application page after login.

Desired Behavior

1. User visits the login page with skip_pref_login=true and an additional redirect URL parameter.

2. User chooses LDAP (or another non‑preferred provider) and authenticates successfully.

3. After authentication, instead of defaulting to common-nav, the system redirects the browser to the user-specified URL.

Requirements / Expectations

• Redirect must occur only after successful authentication.

• Redirect must be validated/whitelisted to avoid open redirect risks.

• Redirect parameter should be optional; existing behavior remains default when not provided.

• Parameter name could be something like:

  • redirect_url

  • post_login_redirect

  • target

• Feature should remain compatible with multi‑IdP environments (OIDC + multiple LDAPs).

Business Justification

This enhancement improves the authentication and navigation experience for users who must authenticate through a non‑preferred identity source—especially:

• QA/test users

• Troubleshooting users

• Service accounts or temporary users

• Integration endpoints that require LDAP authentication before accessing app-specific routes

Benefits include:

• Eliminates 403 errors after login

• Removes confusion and friction in the login flow

• Avoids forcing test users to manually bookmark various application URLs

• Enables smoother testing, demos, and validation workflows

• Reduces support tickets related to login and navigation failures