Description
Open.IdentityServer 1.0.2 defines the standard prompt value:
OidcConstants.PromptModes.Create
However, Constants.SupportedPromptModes does not include it. The collection currently contains only none, login, consent, and select_account.
As a result, an authorization request containing:
is treated as unsupported by AuthorizeRequestValidator and silently ignored. The value is not copied to ValidatedAuthorizeRequest.PromptModes / AuthorizationRequest.PromptModes.
prompt=create is standardized by Initiating User Registration via OpenID Connect and is also exposed by Microsoft.IdentityModel as OpenIdConnectPrompt.Create.
Expected behavior
Open.IdentityServer should provide complete support for prompt=create:
- include
OidcConstants.PromptModes.Create in Constants.SupportedPromptModes;
- expose
create in discovery metadata via prompt_values_supported;
- make it available through
AuthorizationRequest.PromptModes;
- provide a supported interaction mechanism for directing the user to account creation;
- correctly resume the authorization flow after registration;
- include validation and interaction-flow tests.
Additional consideration
Adding Create only to SupportedPromptModes may not be sufficient. AuthorizeInteractionResponseGenerator.ProcessConsentAsync() currently rejects prompt modes other than none and consent after login processing. Since ProcessLoginAsync() does not handle or remove create, a complete implementation likely also needs interaction-generator behavior for this prompt.
Reproduction
- Configure an OpenID Connect client using Authorization Code flow.
- Send a valid authorization request with
prompt=create.
- Inspect the resulting authorization context.
PromptModes does not contain create, and the normal login interaction is used.
Version
- Open.IdentityServer:
1.0.2
- Package repository commit:
114dd0a798cf09455cee618dd4d35e41fe9049d3
Description
Open.IdentityServer 1.0.2 defines the standard prompt value:
However,
Constants.SupportedPromptModesdoes not include it. The collection currently contains onlynone,login,consent, andselect_account.As a result, an authorization request containing:
is treated as unsupported by
AuthorizeRequestValidatorand silently ignored. The value is not copied toValidatedAuthorizeRequest.PromptModes/AuthorizationRequest.PromptModes.prompt=createis standardized by Initiating User Registration via OpenID Connect and is also exposed by Microsoft.IdentityModel asOpenIdConnectPrompt.Create.Expected behavior
Open.IdentityServer should provide complete support for
prompt=create:OidcConstants.PromptModes.CreateinConstants.SupportedPromptModes;createin discovery metadata viaprompt_values_supported;AuthorizationRequest.PromptModes;Additional consideration
Adding
Createonly toSupportedPromptModesmay not be sufficient.AuthorizeInteractionResponseGenerator.ProcessConsentAsync()currently rejects prompt modes other thannoneandconsentafter login processing. SinceProcessLoginAsync()does not handle or removecreate, a complete implementation likely also needs interaction-generator behavior for this prompt.Reproduction
prompt=create.PromptModesdoes not containcreate, and the normal login interaction is used.Version
1.0.2114dd0a798cf09455cee618dd4d35e41fe9049d3