Feat/improved prompt handling

docs/reference/options.rst

@@ -73,12 +73,14 @@ Allows setting length restrictions on various protocol parameters like client id
 UserInteraction
 ^^^^^^^^^^^^^^^
 
-* ``LoginUrl``, ``LogoutUrl``, ``ConsentUrl``, ``ErrorUrl``, ``DeviceVerificationUrl``
-    Sets the URLs for the login, logout, consent, error and device verification pages.
+* ``LoginUrl``, ``LogoutUrl``, ``CreateAccountUrl``, ``ConsentUrl``, ``ErrorUrl``, ``DeviceVerificationUrl``
+    Sets the URLs for the login, logout, create account, consent, error and device verification pages.
 * ``LoginReturnUrlParameter``
     Sets the name of the return URL parameter passed to the login page. Defaults to *returnUrl*.
 * ``LogoutIdParameter``
     Sets the name of the logout message id parameter passed to the logout page. Defaults to *logoutId*.
+* ``CreateAccountIdParameter``
+    Sets the name of the return URL parameter passed to the create account page. Defaults to *returnUrl*.
 * ``ConsentReturnUrlParameter``
     Sets the name of the return URL parameter passed to the consent page. Defaults to *returnUrl*.
 * ``ErrorIdParameter``
@@ -93,6 +95,10 @@ UserInteraction
     The value sets the maximum number of message cookies of any type that will be created.
     The oldest message cookies will be purged once the limit has been reached.
     This effectively indicates how many tabs can be opened by a user when using IdentityServer.
+* ``SupportedPromptModes``
+    Sets the prompt modes that are supported by IdentityServer. 
+    Defaults to *login*, *consent*, *select_account* and *none*.
+    When *CreateAccountUrl* is set, then *create* is also added to the supported prompt modes.
 
 Caching
 ^^^^^^^

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/UserInteractionOptions.cs

@@ -1,8 +1,10 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
 using Open.IdentityServer.Extensions;
+using System.Collections.Generic;
 
 namespace Open.IdentityServer.Configuration;
 
@@ -106,4 +108,28 @@ public class UserInteractionOptions
     /// The device verification user code parameter.
     /// </value>
     public string DeviceVerificationUserCodeParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.UserCode;
+
+    /// <summary>
+    /// Gets or sets the create account URL. If a local URL, the value must start with a leading slash.
+    /// </summary>
+    /// <value>
+    /// The create account URL.
+    /// </value>
+    public string CreateAccountUrl { get; set; }
+
+    /// <summary>
+    /// Gets or sets the create account return URL parameter.
+    /// </summary>
+    /// <value>
+    /// The create account return URL parameter.
+    /// </value>
+    public string CreateAccountReturnUrlParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.CreateAccount;
+
+    /// <summary>
+    /// Gets or sets the supported prompt modes.
+    /// </summary>
+    /// <value>
+    /// The supported prompt modes.
+    /// </value>
+    public List<string> SupportedPromptModes { get; set; } = new(Constants.SupportedPromptModes);
 }

src/Open.IdentityServer/src/Configuration/IdentityServerApplicationBuilderExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -12,6 +13,7 @@
 using System;
 using System.Reflection;
 using System.Threading.Tasks;
+using Open.IdentityServer;
 
 namespace Microsoft.AspNetCore.Builder;
 
@@ -132,6 +134,12 @@ private static void ValidateOptions(IdentityServerOptions options, ILogger logge
         if (options.UserInteraction.ConsentReturnUrlParameter.IsMissing()) throw new InvalidOperationException("ConsentReturnUrlParameter is not configured");
         if (options.UserInteraction.CustomRedirectReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CustomRedirectReturnUrlParameter is not configured");
 
+        if (options.UserInteraction.CreateAccountUrl.IsPresent())
+        {
+            if (options.UserInteraction.CreateAccountReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CreateAccountReturnUrlParameter is not configured");
+            options.UserInteraction.SupportedPromptModes.Add(OidcConstants.PromptModes.Create);
+        }
+
         if (options.Authentication.CheckSessionCookieName.IsMissing()) throw new InvalidOperationException("CheckSessionCookieName is not configured");
 
         if (options.Cors.CorsPolicyName.IsMissing()) throw new InvalidOperationException("CorsPolicyName is not configured");

src/Open.IdentityServer/src/Constants.cs

@@ -113,6 +113,12 @@ public static class SigningAlgorithms
         OidcConstants.PromptModes.SelectAccount
     };
 
+    public class ProcessedParameters
+    {
+        public const string PromptProcessed = OidcConstants.AuthorizeRequest.Prompt + "_processed";
+        public const string MaxAgeProcessed = OidcConstants.AuthorizeRequest.MaxAge + "_processed";
+    }
+
     public static class KnownAcrValues
     {
         public const string HomeRealm = "idp:";
@@ -177,6 +183,7 @@ public static class DefaultRoutePathParams
         {
             public const string Error = "errorId";
             public const string Login = "returnUrl";
+            public const string CreateAccount = "returnUrl";
             public const string Consent = "returnUrl";
             public const string Logout = "logoutId";
             public const string EndSessionCallback = "endSessionId";

src/Open.IdentityServer/src/Endpoints/AuthorizeCallbackEndpoint.cs

@@ -76,6 +76,10 @@ public override async Task<IEndpointResult> ProcessAsync(HttpContext context)
 
         try
         {
+            // Add processed parameters to indicate that they have been processed
+            parameters.Add(Constants.ProcessedParameters.PromptProcessed, "true");
+            parameters.Add(Constants.ProcessedParameters.MaxAgeProcessed, "true");
+
             var result = await ProcessAuthorizeRequestAsync(parameters, user, consent?.Data);
 
             Logger.LogTrace("End Authorize Request. Result type: {0}", result?.GetType().ToString() ?? "-none-");

src/Open.IdentityServer/src/Endpoints/AuthorizeEndpointBase.cs

@@ -95,6 +95,10 @@ internal async Task<IEndpointResult> ProcessAuthorizeRequestAsync(NameValueColle
         {
             return new LoginPageResult(request);
         }
+        if (interactionResult.IsCreateAccount)
+        {
+            return new CreateAccountPageResult(request);
+        }
         if (interactionResult.IsConsent)
         {
             return new ConsentPageResult(request);

src/Open.IdentityServer/src/Endpoints/Results/CreateAccountPageResult.cs

@@ -0,0 +1,47 @@
+// Copyright (c) Rock Solid Knowledge Ltd. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+
+using System.Threading.Tasks;
+using Open.IdentityServer.Validation;
+using Open.IdentityServer.Extensions;
+using Open.IdentityServer.Configuration;
+using Open.IdentityServer.Stores;
+using Microsoft.AspNetCore.Http;
+
+namespace Open.IdentityServer.Endpoints.Results;
+
+/// <summary>
+/// Result for login page
+/// </summary>
+/// <seealso cref="Open.IdentityServer.Endpoints.Results.ReturnUrlResult" />
+public class CreateAccountPageResult : ReturnUrlResult
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateAccountPageResult"/> class.
+    /// </summary>
+    /// <param name="request">The request.</param>
+    /// <exception cref="System.ArgumentNullException">request</exception>
+    public CreateAccountPageResult(ValidatedAuthorizeRequest request):
+        base(request) { }
+
+    internal CreateAccountPageResult(
+        ValidatedAuthorizeRequest request,
+        IdentityServerOptions options,
+        IAuthorizationParametersMessageStore authorizationParametersMessageStore = null): 
+        base(request, options, authorizationParametersMessageStore) { }
+
+    /// <summary>
+    /// Executes the result.
+    /// </summary>
+    /// <param name="context">The HTTP context.</param>
+    public override async Task ExecuteAsync(HttpContext context)
+    {
+        Init(context);
+        var createUrl = Options.UserInteraction.CreateAccountUrl;
+        var returnUrl = await BuildReturnUrl(context, createUrl.IsLocalUrl());
+
+        var url = createUrl.AddQueryString(Options.UserInteraction.CreateAccountReturnUrlParameter, returnUrl);
+        context.Response.RedirectToAbsoluteUrl(url);
+    }
+}

src/Open.IdentityServer/src/Extensions/StringsExtensions.cs

@@ -7,10 +7,13 @@
 using System.Collections.Generic;
 using System.Collections.Specialized;
 using System.Diagnostics;
+using System.Diagnostics.CodeAnalysis;
 using System.Linq;
 using System.Text;
 using System.Text.Encodings.Web;
 
+#nullable enable
+
 namespace Open.IdentityServer.Extensions;
 
 internal static class StringExtensions
@@ -47,7 +50,7 @@ public static IEnumerable<string> FromSpaceSeparatedString(this string input)
         return input.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries).ToList();
     }
 
-    public static List<string> ParseScopesString(this string scopes)
+    public static List<string>? ParseScopesString(this string? scopes)
     {
         if (scopes.IsMissing())
         {
@@ -67,13 +70,13 @@ public static List<string> ParseScopesString(this string scopes)
     }
 
     [DebuggerStepThrough]
-    public static bool IsMissing(this string value)
+    public static bool IsMissing([NotNullWhen(false)] this string? value)
     {
         return string.IsNullOrWhiteSpace(value);
     }
 
     [DebuggerStepThrough]
-    public static bool IsMissingOrTooLong(this string value, int maxLength)
+    public static bool IsMissingOrTooLong(this string? value, int maxLength)
     {
         if (string.IsNullOrWhiteSpace(value))
         {
@@ -89,13 +92,13 @@ public static bool IsMissingOrTooLong(this string value, int maxLength)
     }
 
     [DebuggerStepThrough]
-    public static bool IsPresent(this string value)
+    public static bool IsPresent([NotNullWhen(true)] this string? value)
     {
         return !string.IsNullOrWhiteSpace(value);
     }
 
     [DebuggerStepThrough]
-    public static string EnsureLeadingSlash(this string url)
+    public static string? EnsureLeadingSlash(this string? url)
     {
         if (url != null && !url.StartsWith("/"))
         {
@@ -106,7 +109,7 @@ public static string EnsureLeadingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string EnsureTrailingSlash(this string url)
+    public static string? EnsureTrailingSlash(this string? url)
     {
         if (url != null && !url.EndsWith("/"))
         {
@@ -117,7 +120,7 @@ public static string EnsureTrailingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string RemoveLeadingSlash(this string url)
+    public static string? RemoveLeadingSlash(this string? url)
     {
         if (url != null && url.StartsWith("/"))
         {
@@ -128,7 +131,7 @@ public static string RemoveLeadingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string RemoveTrailingSlash(this string url)
+    public static string? RemoveTrailingSlash(this string? url)
     {
         if (url != null && url.EndsWith("/"))
         {
@@ -139,9 +142,9 @@ public static string RemoveTrailingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string CleanUrlPath(this string url)
+    public static string CleanUrlPath(this string? url)
     {
-        if (String.IsNullOrWhiteSpace(url)) url = "/";
+        if (string.IsNullOrWhiteSpace(url)) url = "/";
 
         if (url != "/" && url.EndsWith("/"))
         {
@@ -153,7 +156,7 @@ public static string CleanUrlPath(this string url)
 
     [DebuggerStepThrough]
     // Clone of UrlHelperBase.CheckIsLocalUrl from https://github.com/dotnet/aspnetcore/blob/3f1acb59718cadf111a0a796681e3d3509bb3381/src/Mvc/Mvc.Core/src/Routing/UrlHelperBase.cs
-    public static bool IsLocalUrl(this string url)
+    public static bool IsLocalUrl(this string? url)
     {
         if (string.IsNullOrEmpty(url))
         {
@@ -246,7 +249,7 @@ public static string AddHashFragment(this string url, string query)
     }
 
     [DebuggerStepThrough]
-    public static NameValueCollection ReadQueryStringAsNameValueCollection(this string url)
+    public static NameValueCollection ReadQueryStringAsNameValueCollection(this string? url)
     {
         if (url != null)
         {
@@ -266,7 +269,7 @@ public static NameValueCollection ReadQueryStringAsNameValueCollection(this stri
         return new NameValueCollection();
     }
 
-    public static string GetOrigin(this string url)
+    public static string? GetOrigin(this string? url)
     {
         if (url != null)
         {

src/Open.IdentityServer/src/Extensions/ValidatedAuthorizeRequestExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -18,16 +19,6 @@ namespace Open.IdentityServer.Validation;
 /// </summary>
 public static class ValidatedAuthorizeRequestExtensions
 {
-    /// <summary>
-    /// Removes the prompt parameter from the request.
-    /// </summary>
-    /// <param name="request">The validated authorize request.</param>
-    public static void RemovePrompt(this ValidatedAuthorizeRequest request)
-    {
-        request.PromptModes = Enumerable.Empty<string>();
-        request.Raw.Remove(OidcConstants.AuthorizeRequest.Prompt);
-    }
-
     /// <summary>
     /// Gets the first ACR value that starts with the specified prefix, with the prefix removed.
     /// </summary>