<![CDATA[Force Google Account Selection on every login]]>We have users with multiple google accounts (private and school accounts, for example).

Some users will mistakenly connect on a private account, which isn't registered with us. FusionAuth automatically creates the account, but user doesn't get registered for our apps that way. So we bounce them out, returning them to our splash page.

Then they try to login again and this time they fall into our app, by-passing the Google account selection screen. The wrong Google account is still active and they get bounced. No easy way to get out of this mess, short of going to a Google site in the browser and logging out.

I'm thinking that perhaps we need to always show the Google account selection screen. For the record we aren't using the canned Google IdP but we've created two (managed and unmanaged) using OpenID. Google docs suggest that prompt=select_account can be passed on the OAuth2 authorization URL. Is there a way to specify options that should be used for each IdP? https://developers.google.com/identity/protocols/oauth2/openid-connect#prompt

]]>https://fusionauth.io/community/forum/topic/663/force-google-account-selection-on-every-loginRSS for NodeSat, 05 Sep 2026 08:28:06 GMTMon, 14 Dec 2020 09:52:04 GMT60<![CDATA[Reply to Force Google Account Selection on every login on Mon, 21 Dec 2020 19:56:46 GMT]]>Added this as a feature request: https://github.com/FusionAuth/fusionauth-issues/issues/1041

]]>https://fusionauth.io/community/forum/post/2021https://fusionauth.io/community/forum/post/2021Mon, 21 Dec 2020 19:56:46 GMT<![CDATA[Reply to Force Google Account Selection on every login on Sat, 19 Dec 2020 03:46:38 GMT]]>Thanks Dan - the manual endpoint configuration did the trick. I put the parameter on the authorization URL.

David

]]>https://fusionauth.io/community/forum/post/2007https://fusionauth.io/community/forum/post/2007Sat, 19 Dec 2020 03:46:38 GMT<![CDATA[Reply to Force Google Account Selection on every login on Fri, 18 Dec 2020 16:22:29 GMT]]>Ah, ok, sorry for misunderstanding what you are trying to accomplish.

There's no standard way of appending additional information to the idp request in FusionAuth. I think it might make sense to add that ability, but that'd be a feature request, to be prioritized along with the other work: https://github.com/fusionauth/fusionauth-issues/issues

As a workaround, this might work.

Can you add uncheck Discover endpoints in the FusionAuth OIDC Identity Provider configuration, and then append prompt=consent or ?prompt=consent to the authorization and token URLs? Then test to see if Google is receiving the additional authentication URI parameters?

]]>https://fusionauth.io/community/forum/post/2000https://fusionauth.io/community/forum/post/2000Fri, 18 Dec 2020 16:22:29 GMT<![CDATA[Reply to Force Google Account Selection on every login on Fri, 18 Dec 2020 04:46:12 GMT]]>Afraid not. This isn't an issue of selecting the right IdP for the user or an issue of wanting to skip FusionAuth login screen .

Once control is passed to Google - I need to ensure that Google prompts the user for Google Account selection. I can't have Google assuming that the user wants to authenticate using the active Google Account - it needs to ask.

]]>https://fusionauth.io/community/forum/post/1999https://fusionauth.io/community/forum/post/1999Fri, 18 Dec 2020 04:46:12 GMT<![CDATA[Reply to Force Google Account Selection on every login on Thu, 17 Dec 2020 12:40:02 GMT]]>Have you seen the idp_hint and login_hint parameters?

They are documented here: https://fusionauth.io/docs/v1/tech/identity-providers/#hints

They don't work for the canned google provider but should work for OIDC providers (and it seems that is what you are using).

Will using these parameters solve the problem?

]]>https://fusionauth.io/community/forum/post/1989https://fusionauth.io/community/forum/post/1989Thu, 17 Dec 2020 12:40:02 GMT