fix(oidc): do not use prompt=none which prevents the login dialog

Signed-off-by: Morgan Martinet <morgan@mmm-experts.com>

app-config.yaml

@@ -312,13 +312,16 @@ auth:
         #
         # scope: saml-login-selector openid profile email
     oidc:
+      # Note that you must define a session secret (above) since the oidc provider requires session support
       development:
         metadataUrl: ${AUTH_OIDC_METADATA_URL}
         clientId: ${AUTH_OIDC_CLIENT_ID}
         clientSecret: ${AUTH_OIDC_CLIENT_SECRET}
         authorizationUrl: ${AUTH_OIDC_AUTH_URL}
         tokenUrl: ${AUTH_OIDC_TOKEN_URL}
-        tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG}
+        tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256'
+        scope: ${AUTH_OIDC_SCOPE}                                      # default='openid profile email'
+        prompt: ${AUTH_OIDC_PROMPT}                                    # default='' (allowed values: '', 'none', 'consent', 'login')
     auth0:
       development:
         clientId: ${AUTH_AUTH0_CLIENT_ID}

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -56,24 +56,27 @@ type AuthResult = {
 export type Options = OAuthProviderOptions & {
   metadataUrl: string;
   scope?: string;
+  prompt?: string;
   tokenSignedResponseAlg?: string;
 };
 
 export class OidcAuthProvider implements OAuthHandlers {
   private readonly implementation: Promise<OidcImpl>;
   private readonly scope?: string;
+  private readonly prompt?: string;
 
   constructor(options: Options) {
     this.implementation = this.setupStrategy(options);
     this.scope = options.scope;
+    this.prompt = options.prompt;
   }
 
   async start(req: OAuthStartRequest): Promise<RedirectInfo> {
     const { strategy } = await this.implementation;
     return await executeRedirectStrategy(req, strategy, {
       accessType: 'offline',
-      prompt: 'none',
-      scope: req.scope || this.scope || '',
+      prompt: this.prompt || '',
+      scope: req.scope || this.scope || 'openid profile email',
       state: encodeState(req.state),
     });
   }
@@ -190,10 +193,11 @@ export const createOidcProvider = (
       const clientSecret = envConfig.getString('clientSecret');
       const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const metadataUrl = envConfig.getString('metadataUrl');
-      const tokenSignedResponseAlg = envConfig.getString(
+      const tokenSignedResponseAlg = envConfig.getOptionalString(
         'tokenSignedResponseAlg',
       );
       const scope = envConfig.getOptionalString('scope');
+      const prompt = envConfig.getOptionalString('prompt');
 
       const provider = new OidcAuthProvider({
         clientId,
@@ -202,6 +206,7 @@ export const createOidcProvider = (
         tokenSignedResponseAlg,
         metadataUrl,
         scope,
+        prompt,
       });
 
       return OAuthAdapter.fromConfig(globalConfig, provider, {