fix(auth): use prompt=login instead of select_account for OIDC sign-in - #347
Open
gabemeola wants to merge 1 commit into
Open
fix(auth): use prompt=login instead of select_account for OIDC sign-in#347gabemeola wants to merge 1 commit into
gabemeola wants to merge 1 commit into
Conversation
select_account is optional in OIDC and IdPs like Clerk reject it with invalid_request, breaking sign-in while the SSO test (which uses login) passes.
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #346
Summary
Custom OIDC sign-in fails for identity providers that don't implement the optional prompt=select_account value. buildGenericOAuthConfigs hardcodes prompt: 'select_account' for every provider, so the authorization request is rejected before authentication and the user is bounced back to /?error=invalid_request.
Reproduction
Configure a Custom OIDC provider backed by Clerk (https:///.well-known/openid-configuration).
Run Test sign-in — succeeds.
Attempt a normal sign-in via the provider button / verified-domain routing — fails and redirects to:
/?error=invalid_request&error_description=...Used+unknown+value+'[select_account]'+for+prom
Root cause
apps/web/src/lib/server/auth/build-oauth-configs.ts sends prompt: 'select_account' on every generic-OAuth config. select_account is optional per OIDC Core §3.1.2.1; providers that don't support it (Clerk, and others) return invalid_request rather than ignoring it.
This also explains why Test sign-in passes but real sign-in fails: the SSO test flow in apps/web/src/lib/server/functions/sso-test.ts already uses prompt: 'login', so the test never exercised the value production actually sends.
Fix
Send prompt: 'login' in production, matching the SSO test flow. login is broadly supported (Clerk, Okta, Auth0, Entra, Google, Keycloak) and preserves the original intent — forcing re-authentication so an admin isn't silently signed in under an existing IdP session. It also removes the test/production divergence, so a passing SSO test now exercises the same prompt production uses.