Make prompt configurable for oidc offline_access

commixon · commixon · commit d33a76fa19d7 · 2020-02-19T16:10:28.000+02:00
diff --git a/Documentation/connectors/oidc.md b/Documentation/connectors/oidc.md
@@ -83,6 +83,11 @@ connectors:
     # The set claim is used as user name.
     # Default: name
     # userNameKey: nickname
+
+    # For offline_access, the prompt parameter is set by default to "prompt=consent". 
+    # However this is not supported by all OIDC providers, some of them support different
+    # value for prompt, like "prompt=login" or "prompt=none"
+    # promptType: consent
 ```
 
 [oidc-doc]: openid-connect.md
diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go
@@ -54,6 +54,9 @@ type Config struct {
 
 	// Configurable key which contains the user name claim
 	UserNameKey string `json:"userNameKey"`
+
+	// PromptType will be used fot the prompt parameter (when offline_access, by default prompt=consent)
+	PromptType string `json:"promptType"`
 }
 
 // Domains that don't support basic auth. golang.org/x/oauth2 has an internal
@@ -113,6 +116,11 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 		scopes = append(scopes, "profile", "email")
 	}
 
+	// PromptType should be "consent" by default, if not set
+	if c.PromptType == "" {
+		c.PromptType = "consent"
+	}
+
 	clientID := c.ClientID
 	return &oidcConnector{
 		provider:    provider,
@@ -135,6 +143,7 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 		getUserInfo:               c.GetUserInfo,
 		userIDKey:                 c.UserIDKey,
 		userNameKey:               c.UserNameKey,
+		promptType:                c.PromptType,
 	}, nil
 }
 
@@ -156,6 +165,7 @@ type oidcConnector struct {
 	getUserInfo               bool
 	userIDKey                 string
 	userNameKey               string
+	promptType                string
 }
 
 func (c *oidcConnector) Close() error {
@@ -178,7 +188,7 @@ func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string)
 	}
 
 	if s.OfflineAccess {
-		opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", "consent"))
+		opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", c.promptType))
 	}
 	return c.oauth2Config.AuthCodeURL(state, opts...), nil
 }

Original file line number	Diff line number	Diff line change
`@@ -54,6 +54,9 @@ type Config struct {`
`54`	`54`
`55`	`55`	`// Configurable key which contains the user name claim`
`56`	`56`	UserNameKey string `json:"userNameKey"`
	`57`	`+`
	`58`	`+ // PromptType will be used fot the prompt parameter (when offline_access, by default prompt=consent)`
	`59`	+ PromptType string `json:"promptType"`
`57`	`60`	`}`
`58`	`61`
`59`	`62`	`// Domains that don't support basic auth. golang.org/x/oauth2 has an internal`
`@@ -113,6 +116,11 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e`
`113`	`116`	`scopes = append(scopes, "profile", "email")`
`114`	`117`	`}`
`115`	`118`
	`119`	`+ // PromptType should be "consent" by default, if not set`
	`120`	`+ if c.PromptType == "" {`
	`121`	`+ c.PromptType = "consent"`
	`122`	`+ }`
	`123`	`+`
`116`	`124`	`clientID := c.ClientID`
`117`	`125`	`return &oidcConnector{`
`118`	`126`	`provider: provider,`
`@@ -135,6 +143,7 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e`
`135`	`143`	`getUserInfo: c.GetUserInfo,`
`136`	`144`	`userIDKey: c.UserIDKey,`
`137`	`145`	`userNameKey: c.UserNameKey,`
	`146`	`+ promptType: c.PromptType,`
`138`	`147`	`}, nil`
`139`	`148`	`}`
`140`	`149`
`@@ -156,6 +165,7 @@ type oidcConnector struct {`
`156`	`165`	`getUserInfo bool`
`157`	`166`	`userIDKey string`
`158`	`167`	`userNameKey string`
	`168`	`+ promptType string`
`159`	`169`	`}`
`160`	`170`
`161`	`171`	`func (c *oidcConnector) Close() error {`
`@@ -178,7 +188,7 @@ func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string)`
`178`	`188`	`}`
`179`	`189`
`180`	`190`	`if s.OfflineAccess {`
`181`		`- opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", "consent"))`
	`191`	`+ opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", c.promptType))`
`182`	`192`	`}`
`183`	`193`	`return c.oauth2Config.AuthCodeURL(state, opts...), nil`
`184`	`194`	`}`