diff --git a/includes/openid-connect-generic-client-wrapper.php b/includes/openid-connect-generic-client-wrapper.php index 4466778a..1a7912f4 100644 --- a/includes/openid-connect-generic-client-wrapper.php +++ b/includes/openid-connect-generic-client-wrapper.php @@ -211,6 +211,7 @@ public function get_authentication_url( $atts = array() ) { 'redirect_uri' => $this->client->get_redirect_uri(), 'redirect_to' => $this->get_redirect_to(), 'acr_values' => $this->settings->acr_values, + 'prompt' => $this->settings->require_prompt ? 'login' : '', ), $atts, 'openid_connect_generic_auth_url' @@ -230,6 +231,9 @@ public function get_authentication_url( $atts = array() ) { if ( ! empty( $atts['acr_values'] ) ) { $url_format .= '&acr_values=%7$s'; } + if ( ! empty( $atts['prompt'] ) ) { + $url_format .= '&prompt=%8$s'; + } $url = sprintf( $url_format, @@ -239,7 +243,8 @@ public function get_authentication_url( $atts = array() ) { rawurlencode( $atts['client_id'] ), $this->client->new_state( $atts['redirect_to'] ), rawurlencode( $atts['redirect_uri'] ), - rawurlencode( $atts['acr_values'] ) + rawurlencode( $atts['acr_values'] ), + rawurlencode( $atts['prompt'] ) ); $url = apply_filters( 'openid-connect-generic-auth-url', $url ); diff --git a/includes/openid-connect-generic-option-settings.php b/includes/openid-connect-generic-option-settings.php index 58e640b1..b1247db2 100644 --- a/includes/openid-connect-generic-option-settings.php +++ b/includes/openid-connect-generic-option-settings.php @@ -44,6 +44,7 @@ * @property string $email_format The key(s) in the user claim array to formulate the user's email address. * @property string $displayname_format The key(s) in the user claim array to formulate the user's display name. * @property bool $identify_with_username The flag which indicates how the user's identity will be determined. + * @property bool $require_prompt The flag which tells the IdP to show the login prompt every time. * @property int $state_time_limit The valid time limit of the state, in seconds. Defaults to 180 seconds. * * Plugin Settings: diff --git a/includes/openid-connect-generic-settings-page.php b/includes/openid-connect-generic-settings-page.php index 9543dd26..68011432 100644 --- a/includes/openid-connect-generic-settings-page.php +++ b/includes/openid-connect-generic-settings-page.php @@ -342,6 +342,12 @@ private function get_settings_fields() { 'type' => 'checkbox', 'section' => 'client_settings', ), + 'require_prompt' => array( + 'title' => __( 'Require Prompt', 'daggerhart-openid-connect-generic' ), + 'description' => __( 'If checked, the IdP will always show the login prompt, regardless of whether the user used Remember Me.', 'daggerhart-openid-connect-generic' ), + 'type' => 'checkbox', + 'section' => 'client_settings', + ), 'state_time_limit' => array( 'title' => __( 'State time limit', 'daggerhart-openid-connect-generic' ), 'description' => __( 'State valid time in seconds. Defaults to 180', 'daggerhart-openid-connect-generic' ), diff --git a/openid-connect-generic.php b/openid-connect-generic.php index 658b45e9..6b14d4ea 100644 --- a/openid-connect-generic.php +++ b/openid-connect-generic.php @@ -356,6 +356,7 @@ public static function bootstrap() { 'email_format' => '{email}', 'displayname_format' => '', 'identify_with_username' => false, + 'require_prompt' => false, // Plugin settings. 'enforce_privacy' => defined( 'OIDC_ENFORCE_PRIVACY' ) ? intval( OIDC_ENFORCE_PRIVACY ) : 0,