feat: improved prompt handling

docs/reference/options.rst

@@ -73,12 +73,14 @@ Allows setting length restrictions on various protocol parameters like client id
 UserInteraction
 ^^^^^^^^^^^^^^^
 
-* ``LoginUrl``, ``LogoutUrl``, ``ConsentUrl``, ``ErrorUrl``, ``DeviceVerificationUrl``
-    Sets the URLs for the login, logout, consent, error and device verification pages.
+* ``LoginUrl``, ``LogoutUrl``, ``CreateAccountUrl``, ``ConsentUrl``, ``ErrorUrl``, ``DeviceVerificationUrl``
+    Sets the URLs for the login, logout, create account, consent, error and device verification pages.
 * ``LoginReturnUrlParameter``
     Sets the name of the return URL parameter passed to the login page. Defaults to *returnUrl*.
 * ``LogoutIdParameter``
     Sets the name of the logout message id parameter passed to the logout page. Defaults to *logoutId*.
+* ``CreateAccountIdParameter``
+    Sets the name of the return URL parameter passed to the create account page. Defaults to *returnUrl*.
 * ``ConsentReturnUrlParameter``
     Sets the name of the return URL parameter passed to the consent page. Defaults to *returnUrl*.
 * ``ErrorIdParameter``
@@ -93,6 +95,11 @@ UserInteraction
     The value sets the maximum number of message cookies of any type that will be created.
     The oldest message cookies will be purged once the limit has been reached.
     This effectively indicates how many tabs can be opened by a user when using IdentityServer.
+* ``SupportedPromptModes``
+    Sets the prompt modes that are supported by IdentityServer. 
+    Defaults to *login*, *consent*, *select_account* and *none*.
+    When *CreateAccountUrl* is set, then *create* is also added to the supported prompt modes.
+    Prompts that are not in this list will cause authorization requests to fail with an invalid_request error.
 
 Caching
 ^^^^^^^

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/UserInteractionOptions.cs

@@ -1,8 +1,10 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
 using Open.IdentityServer.Extensions;
+using System.Collections.Generic;
 
 namespace Open.IdentityServer.Configuration;
 
@@ -106,4 +108,28 @@ public class UserInteractionOptions
     /// The device verification user code parameter.
     /// </value>
     public string DeviceVerificationUserCodeParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.UserCode;
+
+    /// <summary>
+    /// Gets or sets the create account URL. If a local URL, the value must start with a leading slash.
+    /// </summary>
+    /// <value>
+    /// The create account URL.
+    /// </value>
+    public string CreateAccountUrl { get; set; }
+
+    /// <summary>
+    /// Gets or sets the create account return URL parameter.
+    /// </summary>
+    /// <value>
+    /// The create account return URL parameter.
+    /// </value>
+    public string CreateAccountReturnUrlParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.CreateAccount;
+
+    /// <summary>
+    /// Gets or sets the supported prompt modes. Prompts that are not in this list will cause authorization requests to fail with an invalid_request error.
+    /// </summary>
+    /// <value>
+    /// The supported prompt modes.
+    /// </value>
+    public List<string> SupportedPromptModes { get; set; } = new(Constants.SupportedPromptModes);
 }

src/Open.IdentityServer/src/Configuration/IdentityServerApplicationBuilderExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -12,6 +13,7 @@
 using System;
 using System.Reflection;
 using System.Threading.Tasks;
+using Open.IdentityServer;
 
 namespace Microsoft.AspNetCore.Builder;
 
@@ -132,6 +134,12 @@ private static void ValidateOptions(IdentityServerOptions options, ILogger logge
         if (options.UserInteraction.ConsentReturnUrlParameter.IsMissing()) throw new InvalidOperationException("ConsentReturnUrlParameter is not configured");
         if (options.UserInteraction.CustomRedirectReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CustomRedirectReturnUrlParameter is not configured");
 
+        if (options.UserInteraction.CreateAccountUrl.IsPresent())
+        {
+            if (options.UserInteraction.CreateAccountReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CreateAccountReturnUrlParameter is not configured");
+            options.UserInteraction.SupportedPromptModes.Add(OidcConstants.PromptModes.Create);
+        }
+
         if (options.Authentication.CheckSessionCookieName.IsMissing()) throw new InvalidOperationException("CheckSessionCookieName is not configured");
 
         if (options.Cors.CorsPolicyName.IsMissing()) throw new InvalidOperationException("CorsPolicyName is not configured");

src/Open.IdentityServer/src/Constants.cs

@@ -113,6 +113,12 @@ public static class SigningAlgorithms
         OidcConstants.PromptModes.SelectAccount
     };
 
+    public class ProcessedParameters
+    {
+        public const string PromptProcessed = OidcConstants.AuthorizeRequest.Prompt + "_processed";
+        public const string MaxAgeProcessed = OidcConstants.AuthorizeRequest.MaxAge + "_processed";
+    }
+
     public static class KnownAcrValues
     {
         public const string HomeRealm = "idp:";
@@ -177,6 +183,7 @@ public static class DefaultRoutePathParams
         {
             public const string Error = "errorId";
             public const string Login = "returnUrl";
+            public const string CreateAccount = "returnUrl";
             public const string Consent = "returnUrl";
             public const string Logout = "logoutId";
             public const string EndSessionCallback = "endSessionId";

src/Open.IdentityServer/src/Endpoints/AuthorizeCallbackEndpoint.cs

@@ -76,6 +76,10 @@ public override async Task<IEndpointResult> ProcessAsync(HttpContext context)
 
         try
         {
+            // Add processed parameters to indicate that they have been processed
+            parameters.Add(Constants.ProcessedParameters.PromptProcessed, "true");
+            parameters.Add(Constants.ProcessedParameters.MaxAgeProcessed, "true");
+
             var result = await ProcessAuthorizeRequestAsync(parameters, user, consent?.Data);
 
             Logger.LogTrace("End Authorize Request. Result type: {0}", result?.GetType().ToString() ?? "-none-");

src/Open.IdentityServer/src/Endpoints/AuthorizeEndpointBase.cs

@@ -95,6 +95,10 @@ internal async Task<IEndpointResult> ProcessAuthorizeRequestAsync(NameValueColle
         {
             return new LoginPageResult(request);
         }
+        if (interactionResult.IsCreateAccount)
+        {
+            return new CreateAccountPageResult(request);
+        }
         if (interactionResult.IsConsent)
         {
             return new ConsentPageResult(request);

src/Open.IdentityServer/src/Endpoints/Results/CreateAccountPageResult.cs

@@ -0,0 +1,47 @@
+// Copyright (c) Rock Solid Knowledge Ltd. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+
+using System.Threading.Tasks;
+using Open.IdentityServer.Validation;
+using Open.IdentityServer.Extensions;
+using Open.IdentityServer.Configuration;
+using Open.IdentityServer.Stores;
+using Microsoft.AspNetCore.Http;
+
+namespace Open.IdentityServer.Endpoints.Results;
+
+/// <summary>
+/// Result for login page
+/// </summary>
+/// <seealso cref="Open.IdentityServer.Endpoints.Results.ReturnUrlResult" />
+public class CreateAccountPageResult : ReturnUrlResult
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateAccountPageResult"/> class.
+    /// </summary>
+    /// <param name="request">The request.</param>
+    /// <exception cref="System.ArgumentNullException">request</exception>
+    public CreateAccountPageResult(ValidatedAuthorizeRequest request):
+        base(request) { }
+
+    internal CreateAccountPageResult(
+        ValidatedAuthorizeRequest request,
+        IdentityServerOptions options,
+        IAuthorizationParametersMessageStore authorizationParametersMessageStore = null): 
+        base(request, options, authorizationParametersMessageStore) { }
+
+    /// <summary>
+    /// Executes the result.
+    /// </summary>
+    /// <param name="context">The HTTP context.</param>
+    public override async Task ExecuteAsync(HttpContext context)
+    {
+        Init(context);
+        var createUrl = Options.UserInteraction.CreateAccountUrl;
+        var returnUrl = await BuildReturnUrl(context, createUrl.IsLocalUrl());
+
+        var url = createUrl.AddQueryString(Options.UserInteraction.CreateAccountReturnUrlParameter, returnUrl);
+        context.Response.RedirectToAbsoluteUrl(url);
+    }
+}

src/Open.IdentityServer/src/Extensions/ValidatedAuthorizeRequestExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -18,16 +19,6 @@ namespace Open.IdentityServer.Validation;
 /// </summary>
 public static class ValidatedAuthorizeRequestExtensions
 {
-    /// <summary>
-    /// Removes the prompt parameter from the request.
-    /// </summary>
-    /// <param name="request">The validated authorize request.</param>
-    public static void RemovePrompt(this ValidatedAuthorizeRequest request)
-    {
-        request.PromptModes = Enumerable.Empty<string>();
-        request.Raw.Remove(OidcConstants.AuthorizeRequest.Prompt);
-    }
-
     /// <summary>
     /// Gets the first ACR value that starts with the specified prefix, with the prefix removed.
     /// </summary>

src/Open.IdentityServer/src/ResponseHandling/Default/AuthorizeInteractionResponseGenerator.cs

@@ -39,7 +39,7 @@ public class AuthorizeInteractionResponseGenerator : IAuthorizeInteractionRespon
     /// The clock
     /// </summary>
     protected readonly TimeProvider Clock;
-    
+
     /// <summary>
     /// The telemetry
     /// </summary>
@@ -56,15 +56,15 @@ public class AuthorizeInteractionResponseGenerator : IAuthorizeInteractionRespon
     public AuthorizeInteractionResponseGenerator(
         TimeProvider clock,
         ILogger<AuthorizeInteractionResponseGenerator> logger,
-        IConsentService consent, 
+        IConsentService consent,
         IProfileService profile,
         ITelemetryService telemetry)
     {
         Clock = clock;
         Logger = logger;
         Consent = consent;
         Profile = profile;
-        Telemetry =  telemetry;
+        Telemetry = telemetry;
     }
 
     /// <summary>
@@ -78,8 +78,8 @@ public virtual async Task<InteractionResponse> ProcessInteractionAsync(Validated
         using var trace = Telemetry.Trace(TelemetryConstants.TraceCategories.Basic, this);
         Logger.LogTrace("ProcessInteractionAsync");
 
-        if (consent != null && 
-            consent.Granted == false && 
+        if (consent != null &&
+            consent.Granted == false &&
             consent.Error.HasValue)
         {
             // special case when anonymous user has issued an error prior to authenticating
@@ -93,19 +93,23 @@ public virtual async Task<InteractionResponse> ProcessInteractionAsync(Validated
                 AuthorizationError.LoginRequired => OidcConstants.AuthorizeErrors.LoginRequired,
                 _ => OidcConstants.AuthorizeErrors.AccessDenied
             };
-                
+
             return new InteractionResponse
             {
                 Error = error,
                 ErrorDescription = consent.ErrorDescription
             };
         }
 
-        var result = await ProcessLoginAsync(request);
-
-        if (!result.IsLogin && !result.IsError && !result.IsRedirect)
+        var result = await ProcessCreateAsync(request);
+        if (!result.IsCreateAccount && !result.IsError && !result.IsRedirect)
         {
-            result = await ProcessConsentAsync(request, consent);
+            result = await ProcessLoginAsync(request);
+
+            if (!result.IsLogin && !result.IsError && !result.IsRedirect)
+            {
+                result = await ProcessConsentAsync(request, consent);
+            }
         }
 
         if ((result.IsLogin || result.IsConsent || result.IsRedirect) && request.PromptModes.Contains(OidcConstants.PromptModes.None))
@@ -115,7 +119,7 @@ public virtual async Task<InteractionResponse> ProcessInteractionAsync(Validated
             result = new InteractionResponse
             {
                 Error = result.IsLogin ? OidcConstants.AuthorizeErrors.LoginRequired :
-                    result.IsConsent ? OidcConstants.AuthorizeErrors.ConsentRequired : 
+                    result.IsConsent ? OidcConstants.AuthorizeErrors.ConsentRequired :
                     OidcConstants.AuthorizeErrors.InteractionRequired
             };
         }
@@ -135,24 +139,20 @@ protected internal virtual async Task<InteractionResponse> ProcessLoginAsync(Val
         {
             Logger.LogInformation("Showing login: request contains prompt={0}", request.PromptModes.ToSpaceSeparatedString());
 
-            // remove prompt so when we redirect back in from login page
-            // we won't think we need to force a prompt again
-            request.RemovePrompt();
-
             return new InteractionResponse { IsLogin = true };
         }
 
         // unauthenticated user
         var isAuthenticated = request.Subject.IsAuthenticated();
-            
+
         // user de-activated
         bool isActive = false;
 
         if (isAuthenticated)
         {
             var isActiveCtx = new IsActiveContext(request.Subject, request.Client, IdentityServerConstants.ProfileIsActiveCallers.AuthorizeEndpoint);
             await Profile.IsActiveAsync(isActiveCtx);
-                
+
             isActive = isActiveCtx.IsActive;
         }
 
@@ -206,7 +206,7 @@ protected internal virtual async Task<InteractionResponse> ProcessLoginAsync(Val
             }
         }
         // check external idp restrictions if user not using local idp
-        else if (request.Client.IdentityProviderRestrictions != null && 
+        else if (request.Client.IdentityProviderRestrictions != null &&
                  request.Client.IdentityProviderRestrictions.Any() &&
                  !request.Client.IdentityProviderRestrictions.Contains(currentIdp))
         {
@@ -231,6 +231,28 @@ protected internal virtual async Task<InteractionResponse> ProcessLoginAsync(Val
         return new InteractionResponse();
     }
 
+    /// <summary>
+    /// Processes the create account logic.
+    /// </summary>
+    /// <param name="request">The request.</param>
+    /// <returns>A task that resolves to an <see cref="InteractionResponse"/> indicating whether the create account screen should be shown.</returns>
+    /// <exception cref="ArgumentNullException"><paramref name="request"/> is <see langword="null"/>.</exception>
+    protected internal virtual Task<InteractionResponse> ProcessCreateAsync(ValidatedAuthorizeRequest request)
+    {
+        if (request == null) throw new ArgumentNullException(nameof(request));
+
+        var response = new InteractionResponse();
+
+        if (request.PromptModes.Contains(OidcConstants.PromptModes.Create))
+        {
+            Logger.LogInformation("Showing create account: request contains prompt=create");
+
+            response.IsCreateAccount = true;
+        }
+
+        return Task.FromResult(response);
+    }
+
     /// <summary>
     /// Processes the consent logic.
     /// </summary>
@@ -294,7 +316,7 @@ protected internal virtual async Task<InteractionResponse> ProcessConsentAsync(V
                         AuthorizationError.LoginRequired => OidcConstants.AuthorizeErrors.LoginRequired,
                         _ => OidcConstants.AuthorizeErrors.AccessDenied
                     };
-                        
+
                     response.Error = error;
                     response.ErrorDescription = consent.ErrorDescription;
                 }

src/Open.IdentityServer/src/ResponseHandling/Models/InteractionResponse.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -19,6 +20,14 @@ public class InteractionResponse
     /// </value>
     public bool IsLogin { get; set; }
 
+    /// <summary>
+    /// Gets or sets a value indicating whether the user should create an account.
+    /// </summary>
+    /// <value>
+    ///   <c>true</c> if this instance is create; otherwise, <c>false</c>.
+    /// </value>
+    public bool IsCreateAccount { get; set; }
+
     /// <summary>
     /// Gets or sets a value indicating whether the user must consent.
     /// </summary>