From: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Thu, 18 Nov 2021 13:53:44 +0000 (+0100)
Subject: openid: support configuring the prompt
X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=commitdiff_plain;h=348c703875aac5c80b6f2327fe2b9024601203f5;hp=83f0ad5d8d146e21fe21522aac4a6f8ea80b1f74

openid: support configuring the prompt

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index c5bd736..8ed9a8c 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -36,6 +36,7 @@ my $lookup_openid_auth = sub {
 	client_id => $config->{'client-id'},
 	client_key => $config->{'client-key'},
     };
+    $openid_config->{prompt} = $config->{'prompt'} if defined($config->{'prompt'});
 
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index eb6c351..69b5b5e 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -42,6 +42,13 @@ sub properties {
 	    type => 'string',
 	    optional => 1,
 	},
+	prompt => {
+	    description => "Specifies whether the Authorization Server prompts the End-User for"
+	        ." reauthentication and consent.",
+	    type => 'string',
+	    pattern => '(?:none|login|consent|select_account|\S+)', # \S+ is the extension variant
+	    optional => 1,
+	},
    };
 }
 
@@ -52,6 +59,7 @@ sub options {
 	"client-key" => { optional => 1 },
 	autocreate => { optional => 1 },
 	"username-claim" => { optional => 1, fixed => 1 },
+	prompt => { optional => 1 },
 	default => { optional => 1 },
 	comment => { optional => 1 },
     };