search

openiddict / openiddict-core

Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
https://openiddict.com/
Apache License 2.0
4.47k stars 527 forks source link

Validate prompt values specified in authorization requests and update the configuration endpoint to return "prompt_values_supported" #2197

Closed kevinchalet closed 1 month ago

kevinchalet commented 1 month ago

Fixes https://github.com/openiddict/openiddict-core/issues/2185.

This PR fully implements the https://openid.net/specs/openid-connect-prompt-create-1_0.html specification published in 2022.

The OpenIddict server allows using the standard none, login, consent and select_account by default (required by the core OIDC specification), but additional values, like the new create value, can be added using the new options.RegisterPromptValues(...) API.

Note: as part of this PR, I decided to rename the OpenIddictConstants.Prompts class to OpenIddictConstants.PromptValues to match the name used in that specification. We'll need to mention that in the 5.x -> 6.x migration documentation 😃