Start signing in with the identity provider issuer names. The scopes requested are the issuer's configured ones; a caller cannot widen them. Outcomes arrive via datumhue.events. From the root app, a sign-in started while another runs replaces it: the running one ends with no event, and the sign-in page opens again. From any other app, the parent gets an app_identity_sign_in_request to answer.
Name of the configured identity provider to sign in with.
prompt
string
the provider decides what its sign-in page asks for
What the provider's sign-in page asks for, passed to it as given: "login" asks for the credentials again, "consent" asks the user to approve access again.
login_hint
string
the sign-in page starts empty
The account the provider's sign-in page is pre-filled with, typically an email address.
End the running sign-in: in a browser the sign-in window the workstation opened closes; elsewhere the sign-in page can no longer complete it. Every app then gets identity_sign_in_failed with error_kind = "cancelled". Does nothing while no sign-in runs. Root app only: raises from any other app.
Sign out on this workstation: every app and window here signs out, and the sign-in is ended at the deployment where its sign-in service supports that; sign-ins on other devices continue. Outcome arrives via datumhue.events.
Email claim of the current identity, or nil, as the identity provider sent it, verified or not: the address is verified only when identity.claims().email_verified is true.
Every claim of the current identity's ID token as a table, custom claims such as groups included; arrays become sequences and nested objects tables. Nil when signed out, and for a sign-in restored at start-up until its first refresh, which identity_refreshed announces. A restored sign-in holds only sub and iss until a refresh brings an ID token that verifies.
Example
local claims = datumhue.identity.claims()
if claims and claims.groups thenfor _, group inipairs(claims.groups) doprint(group)
endend