Feat/improved prompt handling

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/UserInteractionOptions.cs

@@ -1,8 +1,10 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
 using Open.IdentityServer.Extensions;
+using System.Collections.Generic;
 
 namespace Open.IdentityServer.Configuration;
 
@@ -106,4 +108,28 @@ public class UserInteractionOptions
     /// The device verification user code parameter.
     /// </value>
     public string DeviceVerificationUserCodeParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.UserCode;
+
+    /// <summary>
+    /// Gets or sets the create account URL. If a local URL, the value must start with a leading slash.
+    /// </summary>
+    /// <value>
+    /// The create account URL.
+    /// </value>
+    public string CreateAccountUrl { get; set; }
+
+    /// <summary>
+    /// Gets or sets the create account return URL parameter.
+    /// </summary>
+    /// <value>
+    /// The create account return URL parameter.
+    /// </value>
+    public string CreateAccountReturnUrlParameter { get; set; } = Constants.UIConstants.DefaultRoutePathParams.CreateAccount;
+
+    /// <summary>
+    /// Gets or sets the supported prompt modes.
+    /// </summary>
+    /// <value>
+    /// The supported prompt modes.
+    /// </value>
+    public List<string> SupportedPromptModes { get; set; } = Constants.SupportedPromptModes;
 }

src/Open.IdentityServer/src/Configuration/IdentityServerApplicationBuilderExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -12,6 +13,7 @@
 using System;
 using System.Reflection;
 using System.Threading.Tasks;
+using Open.IdentityServer;
 
 namespace Microsoft.AspNetCore.Builder;
 
@@ -132,6 +134,12 @@ private static void ValidateOptions(IdentityServerOptions options, ILogger logge
         if (options.UserInteraction.ConsentReturnUrlParameter.IsMissing()) throw new InvalidOperationException("ConsentReturnUrlParameter is not configured");
         if (options.UserInteraction.CustomRedirectReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CustomRedirectReturnUrlParameter is not configured");
 
+        if (options.UserInteraction.CreateAccountUrl.IsPresent())
+        {
+            if (options.UserInteraction.CreateAccountReturnUrlParameter.IsMissing()) throw new InvalidOperationException("CreateAccountReturnUrlParameter is not configured");
+            options.UserInteraction.SupportedPromptModes.Add(OidcConstants.PromptModes.Create);
+        }
+
         if (options.Authentication.CheckSessionCookieName.IsMissing()) throw new InvalidOperationException("CheckSessionCookieName is not configured");
 
         if (options.Cors.CorsPolicyName.IsMissing()) throw new InvalidOperationException("CorsPolicyName is not configured");

src/Open.IdentityServer/src/Constants.cs

@@ -113,6 +113,9 @@ public static class SigningAlgorithms
         OidcConstants.PromptModes.SelectAccount
     };
 
+    public const string PromptProcessed = OidcConstants.AuthorizeRequest.Prompt + "_processed";
+    public const string MaxAgeProcessed = OidcConstants.AuthorizeRequest.MaxAge + "_processed";
+
     public static class KnownAcrValues
     {
         public const string HomeRealm = "idp:";
@@ -177,6 +180,7 @@ public static class DefaultRoutePathParams
         {
             public const string Error = "errorId";
             public const string Login = "returnUrl";
+            public const string CreateAccount = "returnUrl";
             public const string Consent = "returnUrl";
             public const string Logout = "logoutId";
             public const string EndSessionCallback = "endSessionId";

src/Open.IdentityServer/src/Endpoints/AuthorizeCallbackEndpoint.cs

@@ -76,6 +76,9 @@ public override async Task<IEndpointResult> ProcessAsync(HttpContext context)
 
         try
         {
+            parameters.Add(Constants.PromptProcessed, "true");
+            parameters.Add(Constants.MaxAgeProcessed, "true");
+
             var result = await ProcessAuthorizeRequestAsync(parameters, user, consent?.Data);
 
             Logger.LogTrace("End Authorize Request. Result type: {0}", result?.GetType().ToString() ?? "-none-");

src/Open.IdentityServer/src/Endpoints/AuthorizeEndpointBase.cs

@@ -95,6 +95,10 @@ internal async Task<IEndpointResult> ProcessAuthorizeRequestAsync(NameValueColle
         {
             return new LoginPageResult(request);
         }
+        if (interactionResult.IsCreateAccount)
+        {
+            return new CreateAccountPageResult(request);
+        }
         if (interactionResult.IsConsent)
         {
             return new ConsentPageResult(request);

src/Open.IdentityServer/src/Endpoints/Results/CreateAccountPageResult.cs

@@ -0,0 +1,47 @@
+// Copyright (c) Rock Solid Knowledge Ltd. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
+
+
+using System.Threading.Tasks;
+using Open.IdentityServer.Validation;
+using Open.IdentityServer.Extensions;
+using Open.IdentityServer.Configuration;
+using Open.IdentityServer.Stores;
+using Microsoft.AspNetCore.Http;
+
+namespace Open.IdentityServer.Endpoints.Results;
+
+/// <summary>
+/// Result for login page
+/// </summary>
+/// <seealso cref="Open.IdentityServer.Endpoints.Results.ReturnUrlResult" />
+public class CreateAccountPageResult : ReturnUrlResult
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="CreateAccountPageResult"/> class.
+    /// </summary>
+    /// <param name="request">The request.</param>
+    /// <exception cref="System.ArgumentNullException">request</exception>
+    public CreateAccountPageResult(ValidatedAuthorizeRequest request):
+        base(request) { }
+
+    internal CreateAccountPageResult(
+        ValidatedAuthorizeRequest request,
+        IdentityServerOptions options,
+        IAuthorizationParametersMessageStore authorizationParametersMessageStore = null): 
+        base(request, options, authorizationParametersMessageStore) { }
+
+    /// <summary>
+    /// Executes the result.
+    /// </summary>
+    /// <param name="context">The HTTP context.</param>
+    public override async Task ExecuteAsync(HttpContext context)
+    {
+        Init(context);
+        var createUrl = Options.UserInteraction.CreateAccountUrl;
+        var returnUrl = await BuildReturnUrl(context, createUrl.IsLocalUrl());
+
+        var url = createUrl.AddQueryString(Options.UserInteraction.CreateAccountReturnUrlParameter, returnUrl);
+        context.Response.RedirectToAbsoluteUrl(url);
+    }
+}

src/Open.IdentityServer/src/Extensions/StringsExtensions.cs

@@ -7,10 +7,13 @@
 using System.Collections.Generic;
 using System.Collections.Specialized;
 using System.Diagnostics;
+using System.Diagnostics.CodeAnalysis;
 using System.Linq;
 using System.Text;
 using System.Text.Encodings.Web;
 
+#nullable enable
+
 namespace Open.IdentityServer.Extensions;
 
 internal static class StringExtensions
@@ -47,7 +50,7 @@ public static IEnumerable<string> FromSpaceSeparatedString(this string input)
         return input.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries).ToList();
     }
 
-    public static List<string> ParseScopesString(this string scopes)
+    public static List<string>? ParseScopesString(this string? scopes)
     {
         if (scopes.IsMissing())
         {
@@ -67,13 +70,13 @@ public static List<string> ParseScopesString(this string scopes)
     }
 
     [DebuggerStepThrough]
-    public static bool IsMissing(this string value)
+    public static bool IsMissing([NotNullWhen(false)] this string? value)
     {
         return string.IsNullOrWhiteSpace(value);
     }
 
     [DebuggerStepThrough]
-    public static bool IsMissingOrTooLong(this string value, int maxLength)
+    public static bool IsMissingOrTooLong(this string? value, int maxLength)
     {
         if (string.IsNullOrWhiteSpace(value))
         {
@@ -89,13 +92,13 @@ public static bool IsMissingOrTooLong(this string value, int maxLength)
     }
 
     [DebuggerStepThrough]
-    public static bool IsPresent(this string value)
+    public static bool IsPresent([NotNullWhen(true)] this string? value)
     {
         return !string.IsNullOrWhiteSpace(value);
     }
 
     [DebuggerStepThrough]
-    public static string EnsureLeadingSlash(this string url)
+    public static string? EnsureLeadingSlash(this string? url)
     {
         if (url != null && !url.StartsWith("/"))
         {
@@ -106,7 +109,7 @@ public static string EnsureLeadingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string EnsureTrailingSlash(this string url)
+    public static string? EnsureTrailingSlash(this string? url)
     {
         if (url != null && !url.EndsWith("/"))
         {
@@ -117,7 +120,7 @@ public static string EnsureTrailingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string RemoveLeadingSlash(this string url)
+    public static string? RemoveLeadingSlash(this string? url)
     {
         if (url != null && url.StartsWith("/"))
         {
@@ -128,7 +131,7 @@ public static string RemoveLeadingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string RemoveTrailingSlash(this string url)
+    public static string? RemoveTrailingSlash(this string? url)
     {
         if (url != null && url.EndsWith("/"))
         {
@@ -139,9 +142,9 @@ public static string RemoveTrailingSlash(this string url)
     }
 
     [DebuggerStepThrough]
-    public static string CleanUrlPath(this string url)
+    public static string CleanUrlPath(this string? url)
     {
-        if (String.IsNullOrWhiteSpace(url)) url = "/";
+        if (string.IsNullOrWhiteSpace(url)) url = "/";
 
         if (url != "/" && url.EndsWith("/"))
         {
@@ -153,7 +156,7 @@ public static string CleanUrlPath(this string url)
 
     [DebuggerStepThrough]
     // Clone of UrlHelperBase.CheckIsLocalUrl from https://github.com/dotnet/aspnetcore/blob/3f1acb59718cadf111a0a796681e3d3509bb3381/src/Mvc/Mvc.Core/src/Routing/UrlHelperBase.cs
-    public static bool IsLocalUrl(this string url)
+    public static bool IsLocalUrl(this string? url)
     {
         if (string.IsNullOrEmpty(url))
         {
@@ -246,7 +249,7 @@ public static string AddHashFragment(this string url, string query)
     }
 
     [DebuggerStepThrough]
-    public static NameValueCollection ReadQueryStringAsNameValueCollection(this string url)
+    public static NameValueCollection ReadQueryStringAsNameValueCollection(this string? url)
     {
         if (url != null)
         {
@@ -266,7 +269,7 @@ public static NameValueCollection ReadQueryStringAsNameValueCollection(this stri
         return new NameValueCollection();
     }
 
-    public static string GetOrigin(this string url)
+    public static string? GetOrigin(this string? url)
     {
         if (url != null)
         {

src/Open.IdentityServer/src/Extensions/ValidatedAuthorizeRequestExtensions.cs

@@ -1,4 +1,5 @@
 // Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
+// Modified by Rock Solid Knowledge Ltd. Copyright in modifications 2026, Rock Solid Knowledge Ltd.
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
@@ -18,16 +19,6 @@ namespace Open.IdentityServer.Validation;
 /// </summary>
 public static class ValidatedAuthorizeRequestExtensions
 {
-    /// <summary>
-    /// Removes the prompt parameter from the request.
-    /// </summary>
-    /// <param name="request">The validated authorize request.</param>
-    public static void RemovePrompt(this ValidatedAuthorizeRequest request)
-    {
-        request.PromptModes = Enumerable.Empty<string>();
-        request.Raw.Remove(OidcConstants.AuthorizeRequest.Prompt);
-    }
-
     /// <summary>
     /// Gets the first ACR value that starts with the specified prefix, with the prefix removed.
     /// </summary>