[GH-ISSUE #2036] Authentik Login needs to be done 2x becouse of prompt=login #585

Closed
opened 2026-02-26 18:47:40 +03:00 by kerem · 3 comments
Owner

Originally created by @MagicMuffin2 on GitHub (Sep 18, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/2036

Issue Description

When using OIDC via Authentik, I always need to log in twice in Authentik. Additionally, Kerberos authentication does not work.

The root cause seems to be that the application appends a prompt=login parameter to the authorization request.

If this parameter is not present in the login URL that Documenso redirects me to, the issue disappears.

Steps to Reproduce

  1. Configure OIDC with Authentik as the identity provider.

  2. Attempt to log in via Documenso.

  3. Observe that Authentik asks for credentials twice (or Kerberos fails).

Expected Behavior

A single login prompt (or Kerberos SSO should work seamlessly).

Current Behavior

prompt=login is added to the OIDC request URL, causing:

Double login in Authentik.

Kerberos authentication to fail.

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

Windows 11

Browser [e.g., Chrome, Firefox]

Chrome

Version [e.g., 2.0.1]

v1.12.4

Please check the boxes that apply to this issue report.

  • I have searched the existing issues to make sure this is not a duplicate.
  • I have provided steps to reproduce the issue.
  • I have included relevant environment information.
  • I have included any relevant screenshots.
  • I understand that this is a voluntary contribution and that there is no guarantee of resolution.
  • I want to work on creating a PR for this issue if approved
Originally created by @MagicMuffin2 on GitHub (Sep 18, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/2036 ### Issue Description When using OIDC via Authentik, I always need to log in twice in Authentik. Additionally, Kerberos authentication does not work. The root cause seems to be that the application appends a prompt=login parameter to the authorization request. If this parameter is not present in the login URL that Documenso redirects me to, the issue disappears. ### Steps to Reproduce 1. Configure OIDC with Authentik as the identity provider. 2. Attempt to log in via Documenso. 3. Observe that Authentik asks for credentials twice (or Kerberos fails). ### Expected Behavior A single login prompt (or Kerberos SSO should work seamlessly). ### Current Behavior prompt=login is added to the OIDC request URL, causing: Double login in Authentik. Kerberos authentication to fail. ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] Windows 11 ### Browser [e.g., Chrome, Firefox] Chrome ### Version [e.g., 2.0.1] v1.12.4 ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [x] I want to work on creating a PR for this issue if approved
kerem 2026-02-26 18:47:40 +03:00
Author
Owner

@github-actions[bot] commented on GitHub (Sep 18, 2025):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

<!-- gh-comment-id:3305464563 --> @github-actions[bot] commented on GitHub (Sep 18, 2025): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)
Author
Owner

@MagicMuffin2 commented on GitHub (Sep 18, 2025):

I would like to work an this issue and already have a fix ready.

<!-- gh-comment-id:3305591193 --> @MagicMuffin2 commented on GitHub (Sep 18, 2025): I would like to work an this issue and already have a fix ready.
Author
Owner

@KarloDerEchte commented on GitHub (Jan 27, 2026):

Due to the recent https://github.com/documenso/documenso/pull/2037 the bug is partially back again. For me i can currently workaround it when using 'consent'. But none triggers a invalid state error.

A Option should still be added to completly remove this prompt parameter which my last merge request already did.

<!-- gh-comment-id:3806722008 --> @KarloDerEchte commented on GitHub (Jan 27, 2026): Due to the recent https://github.com/documenso/documenso/pull/2037 the bug is partially back again. For me i can currently workaround it when using 'consent'. But none triggers a invalid state error. A Option should still be added to completly remove this prompt parameter which my last merge request already did.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/documenso#585
No description provided.