fix: only use the prompt param for the authorization and token endpoints if defined in NC config, drop 'consent' as the defaut

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

lib/Controller/LoginController.php

@@ -270,9 +270,11 @@ public function login(int $providerId, ?string $redirectUrl = null) {
 			'claims' => json_encode($claims),
 			'state' => $state,
 			'nonce' => $nonce,
-			'prompt' => $oidcConfig['prompt'] ?? 'consent'
 		];
 
+		if ($oidcConfig['prompt']) {
+			$data['prompt'] = $oidcConfig['prompt'];
+		}
 
 		if ($isPkceEnabled) {
 			$data['code_challenge'] = $this->toCodeChallenge($code_verifier);

lib/Service/TokenService.php

@@ -255,24 +255,28 @@ public function getExchangedToken(string $targetAudience, array $extraScopes = [
 				}
 			}
 			$this->logger->debug('[TokenService] Exchanging the token: ' . $discovery['token_endpoint']);
+			$tokenEndpointParams = [
+				'client_id' => $oidcProvider->getClientId(),
+				'client_secret' => $clientSecret,
+				'grant_type' => 'urn:ietf:params:oauth:grant-type:token-exchange',
+				'subject_token' => $loginToken->getAccessToken(),
+				'subject_token_type' => 'urn:ietf:params:oauth:token-type:access_token',
+				// can also be
+				// urn:ietf:params:oauth:token-type:access_token
+				// or urn:ietf:params:oauth:token-type:id_token
+				// this one will get us an access token and refresh token within the response
+				'requested_token_type' => 'urn:ietf:params:oauth:token-type:refresh_token',
+				'audience' => $targetAudience,
+				'scope' => $scope,
+			];
+			if ($this->config->getSystemValue('user_oidc.prompt') !== '') {
+				// none, consent, login and internal for oauth2 passport server
+				$tokenEndpointParams['prompt'] = $this->config->getSystemValue('user_oidc.prompt');
+			}
 			// more in https://www.keycloak.org/securing-apps/token-exchange
 			$body = $this->clientService->post(
 				$discovery['token_endpoint'],
-				[
-					'client_id' => $oidcProvider->getClientId(),
-					'client_secret' => $clientSecret,
-					'grant_type' => 'urn:ietf:params:oauth:grant-type:token-exchange',
-					'subject_token' => $loginToken->getAccessToken(),
-					'subject_token_type' => 'urn:ietf:params:oauth:token-type:access_token',
-					// can also be
-					// urn:ietf:params:oauth:token-type:access_token
-					// or urn:ietf:params:oauth:token-type:id_token
-					// this one will get us an access token and refresh token within the response
-					'requested_token_type' => 'urn:ietf:params:oauth:token-type:refresh_token',
-					'audience' => $targetAudience,
-					'scope' => $scope,
-					'prompt' => $this->config->getSystemValue('user_oidc.prompt', 'consent') // none,consent,login and internal for oauth2 passport server
-				]
+				$tokenEndpointParams,
 			);
 			$this->logger->debug('[TokenService] Token exchange request params', [
 				'client_id' => $oidcProvider->getClientId(),