Method forwardAuthenticationRequest

consent/strategy_default.go:190–314

(
	ctx context.Context,
	w http.ResponseWriter,
	r *http.Request,
	ar fosite.AuthorizeRequester,
	session *flow.LoginSession,
	f *flow.Flow,
)

}

func (s *defaultStrategy) forwardAuthenticationRequest(
	ctx context.Context,
	w http.ResponseWriter,
	r *http.Request,
	ar fosite.AuthorizeRequester,
	session *flow.LoginSession,
	f *flow.Flow,
) error {
	sessionID := uuid.New()
	skip := false
	subject := ""
	authenticatedAt := time.Time{}

	if session != nil {
		sessionID = session.ID
		skip = true
		subject = session.Subject
		authenticatedAt = time.Time(session.AuthenticatedAt)
	}

	// Let's validate that prompt is actually not "none" if we can't skip authentication
	prompt := stringsx.Splitx(ar.GetRequestForm().Get("prompt"), " ")
	if slices.Contains(prompt, "none") && !skip {
		return errors.WithStack(fosite.ErrLoginRequired.WithHint(`Prompt 'none' was requested, but no existing login session was found.`))
	}

	// Set up csrf/challenge/verifier values
	challenge := strings.ReplaceAll(uuid.New(), "-", "")
	csrf := strings.ReplaceAll(uuid.New(), "-", "")

	// Generate the request URL
	var requestURL string
	if f != nil {
		requestURL = f.RequestURL
	} else {
		oauth2URL := s.r.Config().OAuth2AuthURL(ctx)
		oauth2URL.RawQuery = r.URL.RawQuery
		requestURL = oauth2URL.String()
	}

	var idTokenHintClaims jwt.MapClaims
	if idTokenHint := ar.GetRequestForm().Get("id_token_hint"); len(idTokenHint) > 0 {
		claims, err := s.getIDTokenHintClaims(ctx, idTokenHint)
		if err != nil {
			return err
		}

		idTokenHintClaims = claims
	}

	// Set the session
	cl := sanitizeClientFromRequest(ar)

	if f == nil {
		// Regular grant
		f = &flow.Flow{
			ID:                challenge,
			RequestedScope:    []string(ar.GetRequestedScopes()),