Support OpenID Connect 1.0 prompt=none parameter

[ufkl]

Expected Behavior
To support silent authentication on Authorization Code Flow with PKCE.
Reference: https://auth0.com/docs/login/configure-silent-authentication

Current Behavior
Single Page Application(SPA) is public client. As it can't hold secret, the SPA need integrate with Authorization Server using Authorization Code Flow with PKCE. When access token is expired, SPA need to redirect users to Authorization Server to begin new Authorization Code Flow, result a bad user experience.

[jgrandja]

@ufkl We'll look at adding support for the prompt parameter when we start adding further support for OpenID Connect 1.0. At the moment, we have higher priority items we're working on. We will get to this but it will take some time.

See prompt parameter in 3.1.2.1. Authentication Request

[asiercamara]

Hello,

I just wanted to ask if there is any update on the implementation of this feature in the project. The support for the prompt=none parameter would be very useful to enable silent authentication without interrupting the user in SPA applications.

(Maybe related to #211 work)

Thank you for your time and attention.

[jgrandja]

@asiercamara No updates so far. Given that this feature currently has 4 upvotes, it's on the lower priority scale. We prioritize features for the next release based on upvotes and other factors.

[kuzjka]

Hello,

If providing support only for prompt=none parameter is an option, I can suggest #1351 to fix it.

As a workaround, currently we use custom AuthenticationEntryPoint for this case with corresponding request filters.

[jgrandja]

This is now merged via 19dfcd4.

This commit adds support for prompt=none only. It does not add support for login, consent or select_account.

There are no plans to add support for login or select_account since this specific flow is the responsibility of the authentication sub-system, which is a separate system from the authorization server. See this comment for further details.

We may consider adding support for prompt=consent (related gh-1422) at a later point.

[dciarniello]

I understand how select_account would be the responsibility of the authentication sub-system, I don't understand how that applies to login. How does the flow get to the authentication system if the authorization doesn't set the authenticated state to false when prompt=login?