[Openid-specs-ab] Using Multiple parameters with prompt request parameter

[Hasanthi Purnima Dissanayake]

Hi All,
According to the spec [1] we can use space-delimited multiple values for
prompt request parameter with authorization request.

> prompt OPTIONAL. Space-delimited, case-sensitive list of ASCII string
> values that specifies whether the Authorization Server prompts the End-User
> for reauthentication and consent.


So if we use an authorization request as below what will be the expected
behaviour?

https://localhost:XXXX/authorize?response_type=code&client_id=XXX&redirect_uri=https://localhost/callback&scope=openid&consent=none
login
<https://localhost:9443/oauth2/authorize?response_type=code&client_id=JqB4NGZLMC6L3n4jz094FMls2Joa&redirect_uri=https://localhost/callback&scope=openid&consent=login+consent>
AFAIU If we use login and consent as the prompt request parameter values
the login and consent pages should be prompted forcefully. But My concern
is what will be the default behaviour when we use login and none together
or consent and none together?

Highly appreciate any clarification on this.

[1] http://openid.net/specs/openid-connect-implicit-1_0.html

Thanks,

Hasanthi Dissanayake

Software Engineer | WSO2

E: hasanthi at wso2.com
 | http://wso2.com <http://wso2.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20160822/030b2fcc/attachment.html>