diff --git a/.env b/.env
index 33da6f0904..cf24a91dfb 100644
--- a/.env
+++ b/.env
@@ -13,6 +13,7 @@ ORDER_HISTORY_URL=null
REFRESH_ACCESS_TOKEN_ENDPOINT=null
SEGMENT_KEY=''
SITE_NAME=null
+TPA_UNLINKED_ACCOUNT_PROVISION_URL=null
INFO_EMAIL=''
# ***** Cookies *****
USER_RETENTION_COOKIE_NAME=null
diff --git a/src/config/index.js b/src/config/index.js
index 5a9992190d..c661a98c86 100644
--- a/src/config/index.js
+++ b/src/config/index.js
@@ -19,6 +19,7 @@ const configuration = {
SEARCH_CATALOG_URL: process.env.SEARCH_CATALOG_URL || null,
TOS_AND_HONOR_CODE: process.env.TOS_AND_HONOR_CODE || null,
TOS_LINK: process.env.TOS_LINK || null,
+ TPA_UNLINKED_ACCOUNT_PROVISION_URL: process.env.TPA_UNLINKED_ACCOUNT_PROVISION_URL || null,
// Base container images
BANNER_IMAGE_LARGE: process.env.BANNER_IMAGE_LARGE || '',
BANNER_IMAGE_MEDIUM: process.env.BANNER_IMAGE_MEDIUM || '',
diff --git a/src/login/LoginPage.jsx b/src/login/LoginPage.jsx
index e3fdd29f2f..bc9611b173 100644
--- a/src/login/LoginPage.jsx
+++ b/src/login/LoginPage.jsx
@@ -310,6 +310,18 @@ class LoginPage extends React.Component {
} = this.props;
const { currentProvider, providers, secondaryProviders } = this.props.thirdPartyAuthContext;
+ const unlinkedProvisionUrl = getConfig().TPA_UNLINKED_ACCOUNT_PROVISION_URL;
+
+ /**
+ * When currentProvider exists and we are in a login page, it is
+ * because the third-party authenticated account is not linked.
+ * See also ThirdPartyAuthAlert.jsx.
+ */
+ if (currentProvider && unlinkedProvisionUrl) {
+ window.location.href = unlinkedProvisionUrl;
+ return null;
+ }
+
if (this.tpaHint) {
if (thirdPartyAuthApiStatus === PENDING_STATE) {
return ;
diff --git a/src/login/tests/LoginPage.test.jsx b/src/login/tests/LoginPage.test.jsx
index 1a5c7e9e14..f2ed84d087 100644
--- a/src/login/tests/LoginPage.test.jsx
+++ b/src/login/tests/LoginPage.test.jsx
@@ -766,4 +766,24 @@ describe('LoginPage', () => {
expect(store.dispatch).toHaveBeenCalledWith(loginRemovePasswordResetBanner());
});
+
+ it('should redirect to provisioning URL on unlinked third-party auth account', () => {
+ mergeConfig({
+ TPA_UNLINKED_ACCOUNT_PROVISION_URL: 'http://example.com',
+ });
+
+ store = mockStore({
+ ...initialState,
+ commonComponents: {
+ ...initialState.commonComponents,
+ thirdPartyAuthContext: {
+ ...initialState.commonComponents.thirdPartyAuthContext,
+ currentProvider: ssoProvider.name,
+ },
+ },
+ });
+
+ const loginPage = mount(reduxWrapper());
+ expect(window.location.href).toEqual('http://example.com');
+ });
});