From 4036d634a072672b5054e2cfc665c9e314f64c2c Mon Sep 17 00:00:00 2001 From: Morgan Martinet Date: Wed, 14 Jul 2021 17:01:38 -0400 Subject: [PATCH] use original prompt default value to avoid a breaking change Signed-off-by: Morgan Martinet --- app-config.yaml | 8 ++++++-- plugins/auth-backend/src/providers/oidc/provider.ts | 10 +++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index 20e7470091..57dff422db 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -312,7 +312,11 @@ auth: # # scope: saml-login-selector openid profile email oidc: - # Note that you must define a session secret (above) since the oidc provider requires session support + # Note that you must define a session secret (see above) since the oidc provider requires session support. + # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP. + # You should set prompt to: + # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session + # - login: will force the IDP to always present a login form to the user development: metadataUrl: ${AUTH_OIDC_METADATA_URL} clientId: ${AUTH_OIDC_CLIENT_ID} @@ -321,7 +325,7 @@ auth: tokenUrl: ${AUTH_OIDC_TOKEN_URL} tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256' scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' - prompt: ${AUTH_OIDC_PROMPT} # default='' (allowed values: '', 'none', 'consent', 'login') + prompt: ${AUTH_OIDC_PROMPT} # default=none (allowed values: auto, none, consent, login) auth0: development: clientId: ${AUTH_AUTH0_CLIENT_ID} diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index c98a8f62b3..306adc70f5 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -73,12 +73,16 @@ export class OidcAuthProvider implements OAuthHandlers { async start(req: OAuthStartRequest): Promise { const { strategy } = await this.implementation; - return await executeRedirectStrategy(req, strategy, { + const options: Record = { accessType: 'offline', - prompt: this.prompt || '', scope: req.scope || this.scope || 'openid profile email', state: encodeState(req.state), - }); + }; + const prompt = this.prompt || 'none'; + if (prompt !== 'auto') { + options.prompt = prompt; + } + return await executeRedirectStrategy(req, strategy, options); } async handler(