diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ea8432b0..b6b051c42 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,7 +23,9 @@ - Add support for large cookie sessions by chunking. [GH-211] - Prefer [curve](https://wiki.mozilla.org/Security/Server_Side_TLS) X25519 to P256 for TLS connections. [GH-233] + - Add informational metrics. [GH-227] +- [Google](https://developers.google.com/identity/protocols/OpenIDConnect) now prompts the user to select a user account (by adding `select_account` to the sign in url). This allows a user who has multiple accounts at the authorization server to select amongst the multiple accounts that they may have current sessions for. ## v0.1.0 diff --git a/internal/identity/google.go b/internal/identity/google.go index bf8390a2b..c133e8dd9 100644 --- a/internal/identity/google.go +++ b/internal/identity/google.go @@ -124,7 +124,7 @@ func (p *GoogleProvider) Revoke(accessToken string) error { // prompt=consent to the OAuth redirect URL and will always return a refresh_token. // https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess func (p *GoogleProvider) GetSignInURL(state string) string { - return p.oauth.AuthCodeURL(state, oauth2.AccessTypeOffline, oauth2.ApprovalForce) + return p.oauth.AuthCodeURL(state, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", "select_account consent")) } // Authenticate creates an identity session with google from a authorization code, and follows up