[management,client] PKCE add query parameter flag prompt=login or max… #3824
Conversation
|
|
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a new flag to configure PKCE authentication behavior, allowing the authorization request to include query parameters such as "prompt=login" or "max_age=0". Key changes include adding a new LoginFlag type and related methods in the management service, updating GRPC and proto definitions to carry the flag, and modifying client code and tests to handle the new behavior.
Reviewed Changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| management/server/types/config.go | New LoginFlag enum and helper methods added |
| management/server/grpcserver.go | Mapping LoginFlag from configuration to proto message |
| management/proto/management.proto | New field for LoginFlag added (note comment mismatch) |
| infrastructure_files/*.tmpl and setup.env files | New environment variables to configure the login flag |
| client/internal/pkce_auth.go & auth/pkce_flow*.go | Client integration for the new flag with updated tests |
|
| @@ -99,7 +102,7 @@ func GetPKCEAuthorizationFlowInfo(ctx context.Context, privateKey string, mgmURL | |||
| RedirectURLs: protoPKCEAuthorizationFlow.GetProviderConfig().GetRedirectURLs(), | |||
| UseIDToken: protoPKCEAuthorizationFlow.GetProviderConfig().GetUseIDToken(), | |||
| ClientCertPair: clientCert, | |||
| DisablePromptLogin: protoPKCEAuthorizationFlow.GetProviderConfig().GetDisablePromptLogin(), | |||
There was a problem hiding this comment.
we should keep this one
management/client/common/types.go
Outdated
| // LoginFlagDisabled disables additional login flags | ||
| LoginFlagDisabled LoginFlag = iota | ||
| // LoginFlagPrompt adds prompt=login to the authorization request | ||
| LoginFlagPrompt | ||
| // LoginFlagMaxAge0 adds max_age=0 to the authorization request | ||
| LoginFlagMaxAge0 |
There was a problem hiding this comment.
| // LoginFlagDisabled disables additional login flags | |
| LoginFlagDisabled LoginFlag = iota | |
| // LoginFlagPrompt adds prompt=login to the authorization request | |
| LoginFlagPrompt | |
| // LoginFlagMaxAge0 adds max_age=0 to the authorization request | |
| LoginFlagMaxAge0 | |
| // LoginFlagPrompt adds prompt=login to the authorization request | |
| LoginFlagPrompt LoginFlag = iota | |
| // LoginFlagMaxAge0 adds max_age=0 to the authorization request | |
| LoginFlagMaxAge0 |
We don't need a disabled flag in this case since we have a dedicated field for it with the DisablePromptLogin bool.
Describe your changes
Introduces a new flag for the PKCE authentication flow. When active, this flag appends query parameters such as 'prompt=login' or 'max_age=0' to the authorization request.
Issue ticket number and link
Stack
Checklist