Issue with Dynamic Parameters in IDP Requests

[Manchiz]

Describe the issue:
Dynamic parameters specified in the Additional Query Parameters and Scope fields within the IDP configuration (Identity Providers > OAuth2/OpenID Connect Configuration > OAuth2/OpenID Connect Configuration) are not passed to the IDP request with multi-option scenarios. This occurs because these parameters are not included in the redirection URL to the IDP[1] after selecting the option from multi-option page. However, these dynamic values are correctly mapped and passed when the IDP is configured as the only option in the first step.

How to reproduce:

1. Configure a federated IDP along with Basic Authentication in the first step.

2. Add ${idpreqparam} to both Additional Query Parameters and Scope in the IDP configuration.

3. Initiate the request with the following example URL (replace <client-ID> and <callback-url>):

https://localhost:9443/oauth2/authorize?response_type=code&client_id=<client -ID>&scope=openid+openid+SYSTEM+idpreqparam=testparam&redirect_uri=<callback-url>&response_mode=form_post&code_challenge_method=S256&code_challenge=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&state=request_0

4. Use a network tracer to inspect the parameters and scope in the IDP request.

5. When the IDP is configured with other authentication options in the first step, the dynamic parameters are not present in the IDP request.

6. When the IDP is the only available option in the first step, the dynamic parameters are correctly included in the request.

Expected behavior:
Dynamic additional query parameters should be mapped and passed correctly to the IDP request, regardless of whether the IDP is configured alog with other options or not.

Environment information

• Product Version: 6.1

[1]. https://github.com/wso2-extensions/identity-outbound-auth-oidc/blob/b6eb4bac768d58575c80bd8b2d9f4d4a92af740a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java#L1175C20-L1175C21