diff --git a/addons/api/addon/generated/models/auth-method.js b/addons/api/addon/generated/models/auth-method.js
index 91cbe70d0..0a268a422 100644
--- a/addons/api/addon/generated/models/auth-method.js
+++ b/addons/api/addon/generated/models/auth-method.js
@@ -158,6 +158,13 @@ export default class GeneratedAuthMethodModel extends BaseModel {
})
account_claim_maps;
+ @attr('string-array', {
+ for: 'oidc',
+ emptyArrayIfMissing: true,
+ isNestedAttribute: true,
+ })
+ prompts;
+
// =attributes(ldap)
@attr('boolean', {
diff --git a/addons/api/addon/models/auth-method.js b/addons/api/addon/models/auth-method.js
index d62a93a45..be6edf06c 100644
--- a/addons/api/addon/models/auth-method.js
+++ b/addons/api/addon/models/auth-method.js
@@ -37,6 +37,7 @@ export const options = {
account_claim_maps: {
to: ['sub', 'name', 'email'],
},
+ prompts: ['none', 'consent', 'select_account', 'login'],
},
ldap: {
account_attribute_maps: {
diff --git a/addons/api/mirage/generated/factories/auth-method.js b/addons/api/mirage/generated/factories/auth-method.js
index 2336949df..63cdc3b9f 100644
--- a/addons/api/mirage/generated/factories/auth-method.js
+++ b/addons/api/mirage/generated/factories/auth-method.js
@@ -42,6 +42,7 @@ export default Factory.extend({
signing_algorithms: ['RS256', 'RS384'],
allowed_audiences: ['www.alice.com', 'www.alice.com/admin'],
idp_ca_certs: ['certificate-1234', 'certificate-5678'],
+ prompts: ['consent'],
};
break;
case TYPE_AUTH_METHOD_LDAP:
diff --git a/addons/api/tests/unit/serializers/application-test.js b/addons/api/tests/unit/serializers/application-test.js
index c283f5cfe..81964786f 100644
--- a/addons/api/tests/unit/serializers/application-test.js
+++ b/addons/api/tests/unit/serializers/application-test.js
@@ -165,6 +165,7 @@ module('Unit | Serializer | application', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: [{ value: 'consent' }],
});
let serializedRecord = record.serialize();
@@ -186,6 +187,7 @@ module('Unit | Serializer | application', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: ['consent'],
},
});
});
diff --git a/addons/api/tests/unit/serializers/auth-method-test.js b/addons/api/tests/unit/serializers/auth-method-test.js
index eaeab8164..d23abd471 100644
--- a/addons/api/tests/unit/serializers/auth-method-test.js
+++ b/addons/api/tests/unit/serializers/auth-method-test.js
@@ -65,6 +65,7 @@ module('Unit | Serializer | auth method', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: [{ value: 'none' }],
});
let serializedRecord = record.serialize();
@@ -86,6 +87,7 @@ module('Unit | Serializer | auth method', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: ['none'],
},
});
});
@@ -180,6 +182,7 @@ module('Unit | Serializer | auth method', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: [{ value: 'consent' }],
});
let serializedRecord = record.serialize();
@@ -200,6 +203,7 @@ module('Unit | Serializer | auth method', function (hooks) {
dry_run: true,
issuer: 'http://www.example.net',
max_age: 500,
+ prompts: ['consent'],
},
});
});
@@ -397,6 +401,7 @@ module('Unit | Serializer | auth method', function (hooks) {
issuer: issuer,
max_age: maxAge,
client_secret: 'secret123',
+ prompts: ['consent'],
},
version: 1,
type: TYPE_AUTH_METHOD_OIDC,
@@ -410,6 +415,7 @@ module('Unit | Serializer | auth method', function (hooks) {
allowed_audiences,
signing_algorithms,
idp_ca_certs,
+ prompts,
} = record;
assert.deepEqual(account_claim_maps, [
{ from: 'from', to: 'to' },
@@ -429,6 +435,7 @@ module('Unit | Serializer | auth method', function (hooks) {
{ value: 'certificate-5678' },
]);
assert.strictEqual(record.api_url_prefix, apiUrlPrefix);
+ assert.deepEqual(prompts, [{ value: 'consent' }]);
assert.strictEqual(record.client_id, clientId);
assert.strictEqual(
record.disable_discovered_config_validation,
diff --git a/addons/core/translations/form/en-us.yaml b/addons/core/translations/form/en-us.yaml
index 80edccdf8..84cf1bb38 100644
--- a/addons/core/translations/form/en-us.yaml
+++ b/addons/core/translations/form/en-us.yaml
@@ -119,6 +119,9 @@ to_claim:
signing_algorithms:
label: Signing Algorithms
help: The signing algorithms allowed for the auth method.
+prompts:
+ label: Prompts
+ help: The prompts allowed for an oidc auth method.
algorithm:
label: Algorithm
subject:
diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml
index 7f7ab560b..2ea9cb06d 100644
--- a/addons/core/translations/resources/en-us.yaml
+++ b/addons/core/translations/resources/en-us.yaml
@@ -147,6 +147,18 @@ auth-method:
account_attribute_maps:
label: Account Attribute Maps
help: Attribute maps from custom attributes to the standard fullname and email account attributes. These maps are represented as key=value where the key equals the from_attribute, and the value equals the to_attribute. For example, "preferredName=fullName".
+ consent:
+ label: Consent
+ help: Always require the user to explicitly consent to scopes requested
+ select_account:
+ label: Select Account
+ help: Allow the user to select from multiple accounts from this provider
+ login:
+ label: Login
+ help: Always require the user to log in to this auth provider
+ none:
+ label: None
+ help: Skip prompts if the user is already signed in and has granted consent
section:
connection:
title: Connection
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index 4f03d37d2..5a37a27fb 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -528,6 +528,34 @@
{{/if}}
+