[flyer5200]

Changelog category

• New Feature

Changelog entry

• Support configurable OIDC authorization request parameters for each identity source, including Casdoor provider_hint.

Affected version

• Latest development version

Background and implementation

Some OIDC providers accept additional authorization parameters to direct users to a specific upstream identity provider. For example, Casdoor uses provider_hint to skip its provider selection page.

This change lets administrators configure a JSON object of string parameters for each OIDC identity source. GrantForge persists the settings and includes them in the authorization request while retaining PKCE. Reserved protocol parameters such as state, nonce, redirect_uri, and the PKCE challenge cannot be overridden. Existing configurations default to an empty set. The identity source editor, API schema, and documentation are updated.

Validation

• OIDC settings, federated sign-in, and OpenAPI contract tests
• Identity source view tests, TypeScript type checking, ESLint, and i18n key checks
• Java Checkstyle
• Manual acceptance with Casdoor provider_hint