diff --git a/docs/en/images/account-pro-select-account-parameter.png b/docs/en/images/account-pro-select-account-parameter.png new file mode 100644 index 0000000000..0037fe50e8 Binary files /dev/null and b/docs/en/images/account-pro-select-account-parameter.png differ diff --git a/docs/en/images/account-pro-select-account.png b/docs/en/images/account-pro-select-account.png new file mode 100644 index 0000000000..559b33f9c8 Binary files /dev/null and b/docs/en/images/account-pro-select-account.png differ diff --git a/docs/en/modules/account-pro.md b/docs/en/modules/account-pro.md index e3e7884cc0..84cb8a105d 100644 --- a/docs/en/modules/account-pro.md +++ b/docs/en/modules/account-pro.md @@ -104,6 +104,48 @@ If you use `Social / External Logins`, It is automatically called for authentica ![account-pro-module-local-login-setting](../images/account-pro-module-local-login-setting.png) +### Switching users during OAuth login + +If you have an OAuth/Auth Server application using the Account Pro module, you can pass the `prompt=select_account` parameter to force the user to select an account. + +Example to pass `prompt=select_account` parameter in OpenIdConnect: + +```csharp +.AddAbpOpenIdConnect("oidc", options => +{ + // ... + options.Events = new OpenIdConnectEvents + { + OnRedirectToIdentityProvider = redirectContext => + { + redirectContext.ProtocolMessage.Prompt = "select_account"; + return Task.CompletedTask; + } + }; + // ... +}); +``` + +![account-pro-secect-account](../images/account-pro-select-account-parameter.png) + +You have three options: + +- Continue: The login process will continue with the current account. +- Switch to another account: Will be redirected to the login page to log in with another account. +- Create a new account: Will be redirected to the register page to create a new account. + +> The OAuth login process will continue after the user selects one of the options. + +![account-pro-secect-account](../images/account-pro-select-account.png) + +All available prompt parameters: + +| **Parameter** | **Description** | +|------------------|-------------------------------------------------------------------------------------------------------------| +| `login` | Forces the user to re-authenticate, even if they are already logged in. | +| `consent` | Forces the user to re-consent to the requested permissions, even if they have consented before. | +| `select_account` | Forces the user to select an account, even if they are already logged in (especially relevant if multiple accounts are available). | +| `none` | Does not trigger any prompt. If the user is not logged in, or their consent is not granted, it will return an error or redirect accordingly. | ## Social / External Logins