OAuth2 Clients with the "skip consent" flag fail to execute `prompt=none` flows
Open
@hperl is already working on this.
Since Jul 6, 2023.
bug
- Dominant language
- Shell
- Stars
- 96
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Preflight checklist
- I could not find a solution in the existing issues, docs, nor discussions.
- I agree to follow this project's Code of Conduct.
- I have read and am following this repository's Contribution Guidelines.
- This issue affects my Ory Network project.
- I have joined the Ory Community Slack.
- I am signed up to the Ory Security Patch Newsletter.
Describe the bug
OIDC clients, that have "skip consent" setting enabled, fail to find a previous suitable consent, and instead silently create a new one. This does not make the consent UI pop-up, but fail prompt=none auth requests with consent_required error. Explicitly remembered consents do not have this problem.
The problem is that skip consent is only used in the UI and is not respected in the "find previous consent" logic in Ory Hydra.
Reproducing the bug
- Create client with skip consent flag set to true
- Perform oauth2 flow with
prompt=none - Get
consent_requirederror
Relevant log output
No response
Relevant configuration
No response
Version
master
On which operating system are you observing this issue?
None
In which environment are you deploying?
None
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.