feat: allow third party initiated login requests to trigger strategy

closes #510
closes #564

lib/passport_strategy.js

@@ -84,8 +84,14 @@ OpenIDConnectStrategy.prototype.authenticate = function authenticate(req, option
     const reqParams = client.callbackParams(req);
     const sessionKey = this._key;
 
-    /* start authentication request */
-    if (Object.keys(reqParams).length === 0) {
+    const { 0: parameter, length } = Object.keys(reqParams);
+
+    /**
+     * Start authentication request if this has no authorization response parameters or
+     * this might a login initiated from a third party as per
+     * https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin.
+     */
+    if (length === 0 || (length === 1 && parameter === 'iss')) {
       // provide options object with extra authentication parameters
       const params = {
         state: random(),

test/passport/passport_strategy.test.js

@@ -128,6 +128,28 @@ describe('OpenIDConnectStrategy', () => {
       );
     });
 
+    it('starts authentication requests for TPIL GETs', function () {
+      const params = { iss: 'https://op.example.com' };
+      const strategy = new Strategy({ client: this.client, params }, () => {});
+
+      const req = new MockRequest('GET', '/login/oidc');
+      req.session = {};
+
+      strategy.redirect = sinon.spy();
+      strategy.authenticate(req);
+
+      expect(strategy.redirect.calledOnce).to.be.true;
+      const target = strategy.redirect.firstCall.args[0];
+      expect(target).to.include('redirect_uri=');
+      expect(target).to.include('scope=');
+      expect(req.session).to.have.property('oidc:op.example.com');
+      expect(req.session['oidc:op.example.com']).to.have.keys(
+        'state',
+        'response_type',
+        'code_verifier',
+      );
+    });
+
     it('starts authentication requests for POSTs', function () {
       const strategy = new Strategy({ client: this.client }, () => {});