Per-client Application Start URL and automatic recovery from expired bookmarked login URLs

[perisdr]

Disclaimer

This proposal is not based on actual knowledge of the underlying technical implementation of the INDICE IAM platform. It should be treated as a product-level feature request and a guide for the desired user experience, not as a suggested implementation approach.

---

Problem

A common issue for end users is that they bookmark the IAM login/challenge URL instead of the actual client application URL.

For example, instead of bookmarking:
https://app.contoso.com/
the user bookmarks a transient IAM URL similar to:
https://login.contoso.com/login?ReturnUrl=...

This URL may contain temporary authorization/challenge parameters such as:

• ReturnUrl
• client_id
• redirect_uri
• state
• code_challenge
• code_challenge_method
• acr_values
• scopes and other OIDC/OAuth parameters

When the authorization challenge expires, any future login attempt using the bookmarked IAM URL fails. From the user’s perspective, this looks like a login problem, even though the real issue is that they are reusing an expired login transaction URL.

This creates avoidable support cases and a poor user experience.

---

Proposed solution

Introduce a per-client Application Start URL setting in IAM, and use it to automatically recover users from expired or invalid bookmarked login/challenge URLs.

1. Per-client Application Start URL

IAM Admin should allow administrators to configure a stable application entry point per client.

Example:

Client ID: contoso-app
Application Start URL: https://app.contoso.com/

This URL should represent the correct page that users are allowed to bookmark and use when starting a new login flow.
The setting could be configured at the client/application level in IAM Admin.

Desired behavior

When a user accesses an expired, invalid, or no-longer-usable IAM login/challenge URL:

1. IAM detects that the login/authorization transaction is no longer valid.
2. IAM attempts to identify the related client, where possible.
3. If the client has a configured Application Start URL, IAM automatically redirects the user to that URL (possibly keeping any ReturnURL parameter as well).
4. The client application then starts a fresh authentication flow normally.
5. If IAM cannot safely determine the client, or if no Application Start URL is configured, IAM displays a friendly recovery page explaining that the login link has expired.

Example recovery message:

This login link has expired.

Please access the application from its main page and try again.

If the Application Start URL is known, the page could include:

Continue to application

or IAM could redirect automatically.

2. Optional enhancement: bookmark warning text

IAM login/challenge pages could optionally display a warning informing users not to bookmark the IAM login page.

Example

Do not bookmark this login page.

To access this application in the future, please bookmark the application homepage instead.

If the Application Start URL is configured, IAM could show the correct bookmark URL:

To access this application later, bookmark:
https://app.contoso.com/

This could be controlled per client, for example:

Show bookmark warning: Yes / No
Bookmark warning text: default or custom
Display configured Application Start URL: Yes / No

---

Expected benefits

• Reduces support tickets caused by users bookmarking expired IAM URLs.
• Improves user experience by recovering automatically instead of showing technical errors.
• Allows each client application to define its own safe entry point.
• Avoids requiring end users to understand OIDC/OAuth concepts such as state, ReturnUrl, or PKCE challenges.