BOne thing to keep in mind - I think you'll fall in a similar problem as the one I mention here: Access the authorize request in the Complement Token flow (Actions V1)
Basically, consider:
Basically, consider:
- you use idp A to authenticate on your pc - that sets
externalId: <external id of the idp A>claim on your access token - later you use idp B to authenticate on your phone, that sets
externalId <external id of the idp B>claim on your access token - later on, you re-generate an access token without re-authenticating the external account (e.g.: via a
refresh_tokenflow)
conclusion: since you did not re-authenticate, the metadata will not be re-populated, and as such your pc (where you authenticated using idp A) will have theexternalIdclaim set idp B's value
BOn that matter: I'm also very much looking forward to a way of reliably setting custom token claims based on the authentication (without having to deal with state leakage as authentication/token creation are essentially two separate and asynchronous steps).
Hope this gets possible on Actions V1 (unless it already is and I'm missing something)
Hope this gets possible on Actions V1 (unless it already is and I'm missing something)