bshaffer/oauth2-server-php — pull request #388 by bojanz (2014-05-27 22:02:36+00:00)
Title: [RFC] Add support for the OpenID Connect prompt parameter

Relevant links:
http://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
http://openid.net/specs/openid-connect-core-1_0.html#AuthError

As you can see, prompt = "consent" matches the previous OAuth2 logic, but the error message has changed (from access_denied to consent_required). We should support that at least.
It should also be possible to support prompt = 'none', which this patch tries to do.

I don't really understand how prompt = 'login' should work (when do we redirect with an error message? Right after the first login fail? That sounds dumb)
Maybe that's why Google doesn't support it either: https://developers.google.com/accounts/docs/OAuth2Login#prompt

Notes:
- This change causes validateAuthorizeRequest() to be called twice (once by the OpenID method, once by the parent method), which is dumb and wasteful. Need to find a way around that.
- Not sure if is_null($user_id) is a good way to check that the user is not logged in. Feels a bit hackish.
- Needs tests, of course.