[BUG] Microsoft Entra ID authentication fails with AADSTS90023 due to hardcoded OIDC prompt

[laitco]

Steps to reproduce

1. Configure OpenCloud 7.2.0 with Microsoft Entra ID (OIDC).
2. Install the latest OpenCloud iOS app from the App Store.
3. Add the OpenCloud server URL.
4. Start the OpenID Connect login.
5. Authenticate with Microsoft Entra ID.

Expected behavior

The authentication should complete successfully and the user should be redirected back to the OpenCloud iOS app.

Actual behavior

Authentication fails with Microsoft Entra ID returning:

AADSTS90023: Unsupported 'prompt' value.

The login never completes and no session is established.

Investigation

After debugging the iOS SDK, the issue appears to be caused by a hardcoded OpenID Connect prompt.

OpenCloudSDK/Authentication/OCAuthenticationMethodOpenIDConnect.m

OCAuthenticationMethodOpenIDConnectPrompt : @"select_account consent"

This value is later added unchanged to the authorization request:

@"prompt" : (self.prompt != nil) ? self.prompt : ((NSString *)NSNull.null)

Microsoft Entra ID rejects this prompt with:

AADSTS90023: Unsupported 'prompt' value.

The OpenCloud server is correctly configured:

• /.well-known/openid-configuration returns HTTP 200
• /.well-known/webfinger returns HTTP 200
• Web login using the same Entra ID configuration works successfully

This indicates the problem is specific to the Apple client (iOS/macOS SDK) and not the OpenCloud server.

Suggested fix

The client should not send a hardcoded prompt value.

Possible solutions:

• Do not send the prompt parameter by default.
• Send only select_account.
• Make the prompt configurable depending on the Identity Provider.

Microsoft Entra ID rejects the current default value select_account consent.

Client

iOS version:
Please fill in.

OpenCloud app version:
Latest App Store version.

Device model:
Please fill in.

Server configuration

OpenCloud version:
7.2.0

Identity Provider:
Microsoft Entra ID (OIDC)

Logs

OpenCloud server error log

No relevant server-side errors.

The following endpoints work correctly:

• /.well-known/openid-configuration
• /.well-known/webfinger

Both return HTTP 200.

The authorization flow fails before authentication because Microsoft Entra ID rejects the authorization request with AADSTS90023.

[guruz]

See also the discussion in opencloud-eu/desktop#918
I think it's best to also open something in https://github.com/opencloud-eu/opencloud/issues/ so it gets more visbility.

Maybe the IDP supported prompt could also come via server side webfinger configuration reply?

[laitco]

See also the discussion in opencloud-eu/desktop#918 I think it's best to also open something in https://github.com/opencloud-eu/opencloud/issues/ so it gets more visbility.

Maybe the IDP supported prompt could also come via server side webfinger configuration reply?

In DesktopApp the Issue and PR is closed. What did you recommend to open in Server Repo as general support EntraID? Generally i got EntraID working without roles/groups mapping because these were not being claimed but i am doing a general FR and maybe you can add something to it.