support prompt in addition to approval-prompt

ploxiln · May 24, 2020 · 811707f · 811707f
1 parent 5fb7b7e
commit 811707f
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 2 deletions.
diff --git a/main.go b/main.go
@@ -85,6 +85,7 @@ func mainFlagSet() *flag.FlagSet {
 	flagSet.String("resource", "", "The resource that is protected (Azure AD only)")
 	flagSet.String("validate-url", "", "Access token validation endpoint")
 	flagSet.String("scope", "", "OAuth scope specification")
+	flagSet.String("prompt", "", "OIDC prompt (overrides approval-prompt)")
 	flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
 
 	flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

diff --git a/options.go b/options.go
@@ -80,7 +80,8 @@ type Options struct {
 	ProtectedResource string `flag:"resource" cfg:"resource"`
 	ValidateURL       string `flag:"validate-url" cfg:"validate_url"`
 	Scope             string `flag:"scope" cfg:"scope"`
-	ApprovalPrompt    string `flag:"approval-prompt" cfg:"approval_prompt"`
+	Prompt            string `flag:"prompt" cfg:"prompt"`
+	ApprovalPrompt    string `flag:"approval-prompt" cfg:"approval_prompt"` // Deprecated by OIDC 1.0
 
 	XHeaders             bool   `flag:"xheaders" cfg:"xheaders"`
 	RequestLogging       bool   `flag:"request-logging" cfg:"request_logging"`
@@ -119,6 +120,7 @@ func NewOptions() *Options {
 		PassUserHeaders:      true,
 		PassAccessToken:      false,
 		PassHostHeader:       true,
+		Prompt:               "", // Change to "login" when ApprovalPrompt deprecated/removed
 		ApprovalPrompt:       "force",
 		XHeaders:             true,
 		RequestLogging:       true,
@@ -235,6 +237,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {
 		Scope:          o.Scope,
 		ClientID:       o.ClientID,
 		ClientSecret:   o.ClientSecret,
+		Prompt:         o.Prompt,
 		ApprovalPrompt: o.ApprovalPrompt,
 	}
 	p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

diff --git a/providers/provider_data.go b/providers/provider_data.go
@@ -14,6 +14,7 @@ type ProviderData struct {
 	ProtectedResource *url.URL
 	ValidateURL       *url.URL
 	Scope             string
+	Prompt            string
 	ApprovalPrompt    string
 }
 

diff --git a/providers/provider_default.go b/providers/provider_default.go
@@ -83,7 +83,11 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
 	a = *p.LoginURL
 	params, _ := url.ParseQuery(a.RawQuery)
 	params.Set("redirect_uri", redirectURI)
-	params.Set("approval_prompt", p.ApprovalPrompt)
+	if p.Prompt != "" {
+		params.Set("prompt", p.Prompt)
+	} else { // Legacy variant of the prompt param:
+		params.Set("approval_prompt", p.ApprovalPrompt)
+	}
 	params.Add("scope", p.Scope)
 	params.Set("client_id", p.ClientID)
 	params.Set("response_type", "code")