Fix OIDC forced re-authentication by making prompt configurable

[Jignesh4611]

Fixed #961

Problem

OIDC login always forces re-authentication because prompt=login is hardcoded, ignoring existing IdP sessions.

Solution

• Removed hardcoded prompt=login.
• Made OIDC prompt configurable using OIDC_PROMPT.
• If empty (default), prompt is not sent and existing sessions are reused.

Behavior

• Default: silent SSO (no forced login).
• Optional: force login by setting OIDC_PROMPT=login.

Files changed

• server/passport.js
• server/env.js

[grzegorz-wawrzak-ams]

Any idea where it can be merged?
Thanks!

[tna76874]

Hey there — I also tracked it down to prompt=login to remove the annoying re-login. The suggested change improves usability. If there are no security concerns, it might be merged and bundled in a new release :)

[Jignesh4611]

Thanks! This makes prompt configurable and keeps forced login optional via OIDC_PROMPT=login, so no security behavior is lost. Should be safe to merge.