<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>The behavior could be same, if IdP can return code after signup flow in same browser session.</div><div><br></div>Plus, the prompt handling is up to IdP’s policy.<div><div>Showing login page w/o signup link also OK if it’s IdP’s decision.</div><div>If RP wants to refuse it, RP would need a way to know signup datetime in userinfo response etc.<br><br><div id="AppleMailSignature" dir="ltr">Sent from my iPhone</div><div dir="ltr"><br>On Feb 1, 2019, at 12:15, Brock Allen <<a href="mailto:brockallen@gmail.com">brockallen@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div id="__MailbirdStyleContent" style="font-size: 10pt;font-family: Lucida Console;color: #000000">
> <span style="font-size: 10pt">So that, allowing "prompt=create login” seems meaningful to me.<br></span><div><br></div><div>So then how's this different than the OP just letting the user click on a "register" button from the login page? IOW, wouldn't "create" be implied?</div><div><br></div><div>BTW, it might sound like I'm against this new prompt param -- I'm not. I am just trying to get it straight in my mind.</div><div><br></div><div class="mb_sig"><span style="font-family: Lucida Console">-Brock</span></div>
</div></div></blockquote></div></div></body></html>