fix(auth): use prompt=login instead of select_account for OIDC sign-in - #347
Merged
mortondev merged 1 commit intoJul 31, 2026
Merged
Conversation
select_account is optional in OIDC and IdPs like Clerk reject it with invalid_request, breaking sign-in while the SSO test (which uses login) passes.
|
|
mortondev
approved these changes
Jul 31, 2026
mortondev
left a comment
mortondev
left a comment
Member
There was a problem hiding this comment.
Thanks @gabemeola, happy to merge this. 👍
In future this will become a configuration option, though I agree login should be the default.
Contributor
Author
|
@mortondev Thanks! I'll pull in the next release when ready |
mortondev
added a commit
that referenced
this pull request
Aug 1, 2026
The comment still said "force the account picker" after #347 switched from select_account to login; describe the re-authentication behavior and why login is used over the OIDC-optional select_account.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #346
Summary
Custom OIDC sign-in fails for identity providers that don't implement the optional prompt=select_account value. buildGenericOAuthConfigs hardcodes prompt: 'select_account' for every provider, so the authorization request is rejected before authentication and the user is bounced back to /?error=invalid_request.
Reproduction
Configure a Custom OIDC provider backed by Clerk (https:///.well-known/openid-configuration).
Run Test sign-in — succeeds.
Attempt a normal sign-in via the provider button / verified-domain routing — fails and redirects to:
/?error=invalid_request&error_description=...Used+unknown+value+'[select_account]'+for+prom
Root cause
apps/web/src/lib/server/auth/build-oauth-configs.ts sends prompt: 'select_account' on every generic-OAuth config. select_account is optional per OIDC Core §3.1.2.1; providers that don't support it (Clerk, and others) return invalid_request rather than ignoring it.
This also explains why Test sign-in passes but real sign-in fails: the SSO test flow in apps/web/src/lib/server/functions/sso-test.ts already uses prompt: 'login', so the test never exercised the value production actually sends.
Fix
Send prompt: 'login' in production, matching the SSO test flow. login is broadly supported (Clerk, Okta, Auth0, Entra, Google, Keycloak) and preserves the original intent — forcing re-authentication so an admin isn't silently signed in under an existing IdP session. It also removes the test/production divergence, so a passing SSO test now exercises the same prompt production uses.