SAML2: Add support for additional sp login hints (#2610)

mrdevon · tvdijen · commit 3fd3dfd58101 · 2026-03-10T20:35:15.000+01:00
* Add support from SPs for login_hint & LoginHint #2609 * docs: Add changelog for login_hint & LoginHint HTTP parameters
diff --git a/docs/simplesamlphp-changelog.md b/docs/simplesamlphp-changelog.md
@@ -29,6 +29,7 @@ Released TBD
 * Fix override over errorURL
 * Introduced a new assets.salt to allow cache busting without leaking version information (#2490)
 * If session.check_function is set and can not be called an error is raised (#2498)
+* Add 'login_hint' and 'LoginHint' as additional supported username hints from SPs in HTTP parameters (#2609)
 
 `authorize`
 
diff --git a/modules/saml/src/IdP/SAML2.php b/modules/saml/src/IdP/SAML2.php
@@ -399,6 +399,10 @@ public static function receiveAuthnRequest(IdP $idp): void
 
             if (isset($_REQUEST['username'])) {
                 $username = (string) $_REQUEST['username'];
+            } elseif (isset($_REQUEST['login_hint'])) {
+                $username = (string) $_REQUEST['login_hint'];
+            } elseif (isset($_REQUEST['LoginHint'])) {
+                $username = (string) $_REQUEST['LoginHint'];
             }
 
             $issuer = $request->getIssuer();

Original file line number	Diff line number	Diff line change
`@@ -399,6 +399,10 @@ public static function receiveAuthnRequest(IdP $idp): void`
`399`	`399`
`400`	`400`	`if (isset($_REQUEST['username'])) {`
`401`	`401`	`$username = (string) $_REQUEST['username'];`
	`402`	`+ } elseif (isset($_REQUEST['login_hint'])) {`
	`403`	`+ $username = (string) $_REQUEST['login_hint'];`
	`404`	`+ } elseif (isset($_REQUEST['LoginHint'])) {`
	`405`	`+ $username = (string) $_REQUEST['LoginHint'];`
`402`	`406`	`}`
`403`	`407`
`404`	`408`	`$issuer = $request->getIssuer();`