diff --git a/application/Espo/Core/Authentication/Oidc/ConfigDataProvider.php b/application/Espo/Core/Authentication/Oidc/ConfigDataProvider.php index 7f75464af2..beaec4adce 100644 --- a/application/Espo/Core/Authentication/Oidc/ConfigDataProvider.php +++ b/application/Espo/Core/Authentication/Oidc/ConfigDataProvider.php @@ -214,7 +214,7 @@ class ConfigDataProvider public function getAuthorizationPrompt(): string { - return $this->config->get('oidcAuthorizationPrompt') ?? 'consent'; + return $this->object->get('oidcAuthorizationPrompt') ?? 'consent'; } public function getAuthorizationMaxAge(): ?int diff --git a/application/Espo/Core/Upgrades/Migrations/V8_3/AfterUpgrade.php b/application/Espo/Core/Upgrades/Migrations/V8_3/AfterUpgrade.php index e9be3b6288..a531a4d56f 100644 --- a/application/Espo/Core/Upgrades/Migrations/V8_3/AfterUpgrade.php +++ b/application/Espo/Core/Upgrades/Migrations/V8_3/AfterUpgrade.php @@ -31,7 +31,9 @@ namespace Espo\Core\Upgrades\Migrations\V8_3; use Espo\Core\Templates\Entities\Event; use Espo\Core\Upgrades\Migration\Script; +use Espo\Core\Utils\Config; use Espo\Core\Utils\Metadata; +use Espo\Entities\AuthenticationProvider; use Espo\Entities\Role; use Espo\ORM\EntityManager; use Espo\ORM\Query\Part\Expression; @@ -41,13 +43,15 @@ class AfterUpgrade implements Script { public function __construct( private EntityManager $entityManager, - private Metadata $metadata + private Metadata $metadata, + private Config $config ) {} public function run(): void { $this->updateRoles(); $this->updateMetadata(); + $this->updateAuthenticationProviders(); } private function updateRoles(): void @@ -97,4 +101,17 @@ class AfterUpgrade implements Script $this->metadata->saveCustom('clientDefs', $entityType, $clientDefs); } } + + private function updateAuthenticationProviders(): void + { + $collection = $this->entityManager->getRDBRepositoryByClass(AuthenticationProvider::class) + ->where(['method' => 'Oidc']) + ->find(); + + foreach ($collection as $entity) { + $entity->set('oidcAuthorizationPrompt', $this->config->get('oidcAuthorizationPrompt')); + + $this->entityManager->saveEntity($entity); + } + } } diff --git a/application/Espo/Resources/defaults/config.php b/application/Espo/Resources/defaults/config.php index f4f3f3862b..35e47041f7 100644 --- a/application/Espo/Resources/defaults/config.php +++ b/application/Espo/Resources/defaults/config.php @@ -287,6 +287,7 @@ return [ 'oidcUsernameClaim' => 'sub', 'oidcFallback' => true, 'oidcScopes' => ['profile', 'email', 'phone'], + 'oidcAuthorizationPrompt' => 'consent', 'listViewSettingsDisabled' => false, 'cleanupDeletedRecords' => true, 'phoneNumberNumericSearch' => true, diff --git a/application/Espo/Resources/i18n/en_US/Settings.json b/application/Espo/Resources/i18n/en_US/Settings.json index 0915e4f4b6..a44a53e8c2 100644 --- a/application/Espo/Resources/i18n/en_US/Settings.json +++ b/application/Espo/Resources/i18n/en_US/Settings.json @@ -168,6 +168,7 @@ "oidcAllowRegularUserFallback": "OIDC Allow fallback login for regular users", "oidcAllowAdminUser": "OIDC Allow OIDC login for admin users", "oidcLogoutUrl": "OIDC Logout URL", + "oidcAuthorizationPrompt": "OIDC Authorization Prompt", "pdfEngine": "PDF Engine", "quickSearchFullTextAppendWildcard": "Append wildcard in quick search", "authIpAddressCheck": "Restrict access by IP address", diff --git a/application/Espo/Resources/metadata/authenticationMethods/Oidc.json b/application/Espo/Resources/metadata/authenticationMethods/Oidc.json index 3df347eea3..8e8b0cdccd 100644 --- a/application/Espo/Resources/metadata/authenticationMethods/Oidc.json +++ b/application/Espo/Resources/metadata/authenticationMethods/Oidc.json @@ -93,6 +93,12 @@ { "name": "oidcLogoutUrl" } + ], + [ + { + "name": "oidcAuthorizationPrompt" + }, + false ] ] }, diff --git a/application/Espo/Resources/metadata/entityDefs/AuthenticationProvider.json b/application/Espo/Resources/metadata/entityDefs/AuthenticationProvider.json index 85404ca8f5..2159e3554f 100644 --- a/application/Espo/Resources/metadata/entityDefs/AuthenticationProvider.json +++ b/application/Espo/Resources/metadata/entityDefs/AuthenticationProvider.json @@ -70,6 +70,16 @@ "oidcLogoutUrl": { "type": "varchar", "tooltip": true + }, + "oidcAuthorizationPrompt": { + "type": "enum", + "options": [ + "none", + "consent", + "login", + "select_account" + ], + "maxLength": 14 } } } diff --git a/application/Espo/Resources/metadata/entityDefs/Settings.json b/application/Espo/Resources/metadata/entityDefs/Settings.json index d4571c7656..e486f4bdeb 100644 --- a/application/Espo/Resources/metadata/entityDefs/Settings.json +++ b/application/Espo/Resources/metadata/entityDefs/Settings.json @@ -888,6 +888,15 @@ "type": "varchar", "tooltip": true }, + "oidcAuthorizationPrompt": { + "type": "enum", + "options": [ + "none", + "consent", + "login", + "select_account" + ] + }, "pdfEngine": { "type": "enum", "view": "views/settings/fields/pdf-engine"