openid: support configuring the prompt

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index c5bd736fddb52035a8c22d3b0c3aea7e310eac64..8ed9a8cbde94d7a2cac14867bbd8882011d5a641 100644 (file)
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -36,6 +36,7 @@ my $lookup_openid_auth = sub {
        client_id => $config->{'client-id'},
        client_key => $config->{'client-key'},
     };
+    $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);

diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index eb6c3518d311f0a2034b24d0b1415ccc530a5b82..69b5b5e1912600aca598ac0857875e42b7a44ebe 100755 (executable)
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -42,6 +42,13 @@ sub properties {
            type => 'string',
            optional => 1,
        },
+       prompt => {
+           description => "Specifies whether the Authorization Server prompts the End-User for"
+               ." reauthentication and consent.",
+           type => 'string',
+           pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
+           optional => 1,
+       },
    };
 }
 
@@ -52,6 +59,7 @@ sub options {
        "client-key" => { optional => 1 },
        autocreate => { optional => 1 },
        "username-claim" => { optional => 1, fixed => 1 },
+       prompt => { optional => 1 },
        default => { optional => 1 },
        comment => { optional => 1 },
     };