diff --git a/.env b/.env
index 0556efc762..a37fe0465c 100644
--- a/.env
+++ b/.env
@@ -13,6 +13,7 @@ ORDER_HISTORY_URL=null
REFRESH_ACCESS_TOKEN_ENDPOINT=null
SEGMENT_KEY=''
SITE_NAME=null
+TPA_UNLINKED_ACCOUNT_PROVISION_URL=null
INFO_EMAIL=''
# ***** Cookies *****
REGISTER_CONVERSION_COOKIE_NAME=null
diff --git a/src/config/index.js b/src/config/index.js
index bdfdf0ff9e..bc8a126a89 100644
--- a/src/config/index.js
+++ b/src/config/index.js
@@ -19,6 +19,7 @@ const configuration = {
PRIVACY_POLICY: process.env.PRIVACY_POLICY || null,
TOS_AND_HONOR_CODE: process.env.TOS_AND_HONOR_CODE || null,
TOS_LINK: process.env.TOS_LINK || null,
+ TPA_UNLINKED_ACCOUNT_PROVISION_URL: process.env.TPA_UNLINKED_ACCOUNT_PROVISION_URL || null,
// Miscellaneous
GENERAL_RECOMMENDATIONS: process.env.GENERAL_RECOMMENDATIONS || '[]',
INFO_EMAIL: process.env.INFO_EMAIL || '',
diff --git a/src/login/LoginPage.jsx b/src/login/LoginPage.jsx
index b522f2174e..6352e7f7bb 100644
--- a/src/login/LoginPage.jsx
+++ b/src/login/LoginPage.jsx
@@ -321,6 +321,18 @@ class LoginPage extends React.Component {
} = this.props;
const { currentProvider, providers, secondaryProviders } = this.props.thirdPartyAuthContext;
+ const unlinkedProvisionUrl = getConfig().TPA_UNLINKED_ACCOUNT_PROVISION_URL;
+
+ /**
+ * When currentProvider exists and we are in a login page, it is
+ * because the third-party authenticated account is not linked.
+ * See also ThirdPartyAuthAlert.jsx.
+ */
+ if (currentProvider && unlinkedProvisionUrl) {
+ window.location.href = unlinkedProvisionUrl;
+ return null;
+ }
+
if (this.tpaHint) {
if (thirdPartyAuthApiStatus === PENDING_STATE) {
return ;
diff --git a/src/login/tests/LoginPage.test.jsx b/src/login/tests/LoginPage.test.jsx
index 4a1acdef60..bff876a1ce 100644
--- a/src/login/tests/LoginPage.test.jsx
+++ b/src/login/tests/LoginPage.test.jsx
@@ -791,4 +791,25 @@ describe('LoginPage', () => {
expect(store.dispatch).toHaveBeenCalledWith(loginRemovePasswordResetBanner());
});
+
+ it('should redirect to provisioning URL on unlinked third-party auth account', () => {
+ mergeConfig({
+ TPA_UNLINKED_ACCOUNT_PROVISION_URL: 'http://example.com',
+ });
+
+ store = mockStore({
+ ...initialState,
+ commonComponents: {
+ ...initialState.commonComponents,
+ thirdPartyAuthContext: {
+ ...initialState.commonComponents.thirdPartyAuthContext,
+ currentProvider: ssoProvider.name,
+ },
+ },
+ });
+
+ const loginPage = mount(reduxWrapper());
+ expect(window.location.href).toEqual('http://example.com');
+ loginPage.unmount();
+ });
});