SSO: Add prompt param to SSO settings (#107969)

* add prompt param to AzureAD oauth config

* yarn i18n-extract

* validate auth prompt value

* make login_prompt available for all SSO providers

* use base authCodeURL for azure and google

* add docs for the new field for azure and generic oauth

* fix typo

* fix frontend unit test

* add prompt parameter to docs for the other providers

* remove prompt from okta

* add unit tests for the other providers

* address feedback

* add back translations for prompt labels

pkg/services/ssosettings/strategies/oauth_strategy.go

@@ -108,6 +108,7 @@ func (s *OAuthStrategy) loadSettingsForProvider(provider string) map[string]any
 		"signout_redirect_url":          section.Key("signout_redirect_url").Value(),
 		"org_mapping":                   section.Key("org_mapping").Value(),
 		"org_attribute_path":            section.Key("org_attribute_path").Value(),
+		"login_prompt":                  section.Key("login_prompt").Value(),
 	}
 
 	extraKeys := extraKeysByProvider[provider]

pkg/services/ssosettings/strategies/oauth_strategy_test.go

@@ -58,6 +58,7 @@ var (
 	signout_redirect_url = test_signout_redirect_url
 	org_attribute_path = groups
 	org_mapping = Group1:*:Editor
+	login_prompt = select_account
 	`
 
 	expectedOAuthInfo = map[string]any{
@@ -104,6 +105,7 @@ var (
 		"team_ids":                      "first, second",
 		"org_attribute_path":            "groups",
 		"org_mapping":                   "Group1:*:Editor",
+		"login_prompt":                  "select_account",
 	}
 )
 

pkg/services/ssosettings/validation/oauth_validators.go

@@ -51,6 +51,15 @@ func SkipOrgRoleSyncAllowAssignGrafanaAdminValidator(info *social.OAuthInfo, req
 	return nil
 }
 
+func LoginPromptValidator(info *social.OAuthInfo, requester identity.Requester) error {
+	prompt := info.LoginPrompt
+
+	if prompt != "" && prompt != "login" && prompt != "consent" && prompt != "select_account" {
+		return ssosettings.ErrInvalidOAuthConfig("Invalid value for login_prompt. Valid values are: login, consent, select_account.")
+	}
+	return nil
+}
+
 func RequiredValidator(value string, name string) ssosettings.ValidateFunc[social.OAuthInfo] {
 	return func(info *social.OAuthInfo, requester identity.Requester) error {
 		if value == "" {