prompt=login support appears broken :/

[ciaranj]

Looks to me like the AuthorizeInteractionResponseGenerator#ProcessLogin method needs a minor tweak.

For a client requesting prompt=login and not-yet-authenticated, they were being double-challenged.

I believe this is because the branch

if (!user.Identity.IsAuthenticated)

should contain a clause within that does

request.Raw.Remove(Constants.AuthorizeRequest.Prompt);

As happens when a user is already authenticated, but a login-prompt has been requested. (otherwise un-authenticated users get a double challenge.)

This fix is a literal fix, and re-ordering the existing branches may actually make sure, but wasn't 100% :)