OIDC SL1 - prompt parameter

[deansaxe]

During the discussions on #89 and #90 the prompt parameter was raised as an option to force reauthentication. IPSIE has, to date, not defined any usage of the prompt parameter.

As we work toward the SL1 interop it is imperative that we provide concrete requirements for the use of the prompt parameter to ensure interoperability between OP and RP. As we define the requirements, we need to define the intersection with max_age since setting max_age=0 is effectively setting prompt=login.

I'll queue this up for discussion on the June 23, 2025 call.

[deansaxe]

Deferred to July 1, 2025 call.

[deansaxe]

@gffletch please comment as discussed on the July 8, 2025 call.

[gffletch]

I believe there are a number of different user experiences that could be valuable in the context of the combination of the max_age parameter and the prompt parameter.

Generally, the prompt=login parameter/value pair means that the OpenID Provider (OP) should prompt/re-prompt the user for authentication credentials. Effectively, some explicit user experience is required. The prompt=none parameter/value pair means that the OP MUST NO engage the user with UX and instead return success or error.

Combining these two prompt values with the max_age parameter allows for defining three different user experiences.

1. The user MUST be challenged to solve some authentication method. To enable this both max_age and prompt=login would be specified as part of the authorization request.
2. The user MAY be challenged to solve some authentication method. To enable this just the max_age parameter is provided. If the user's session is within the specified max_age OR the OP can silently authenticate the user, and issue a new auth_time within the required max_age then no user facing UX is required. However, the OP could decided to explicitly challenge the user.
3. The user MUST NOT be challenged. The RP is just checking to see if the current session is within the specified max_age value. In this case max_age and prompt=none must be specified. If the session is outside the defined max_age then the OP MUST return an error.

[deansaxe]

See also #96

[deansaxe]

From the discussion on the July 15, 2025 call, this statement in OIDC Core has too much optionality:

"login
The Authorization Server SHOULD prompt the End-User for reauthentication. If it cannot reauthenticate the End-User, it MUST return an error, typically login_required."

IPSIE OIDC SL1 will reframe this as a MUST. I'll write a PR shortly.

[mcguinness]

An undefined behavior with prompt=login and max_age=0 is related to the sid claim for session identifier. When should the sid value remain the same and when should be changed to a new value. From an RP perspective, one might expect re-auth to keep the existing OP session id vs login creating a new session identifier.

[gffletch]

I agree this in ambiguous. I can also see the desire of prompt=login to be more about... please ensure the user who is currently logged in is still logged in. In that context, the RP would not want the session id to be changed. If the user changes from identity X to identity Y, then the session id MUST change.

[deansaxe]

See #102 as a related issue.