From ba82cefb832a021c98fb2faa647109f68b3fdc22 Mon Sep 17 00:00:00 2001
From: Michael Mayer <michael@photoprism.app>
Date: Sat, 27 Jun 2026 12:39:25 +0000
Subject: [PATCH] Setup: Add PHOTOPRISM_OIDC_PROMPT to compose & Helm examples
 #5698

Lists the new OIDC authorization prompt option alongside the other
PHOTOPRISM_OIDC_ settings (in flag order) in the dev compose files and the
Plus Helm chart values/questions. Empty default preserves current behavior.
---
 compose.intel.yaml               | 1 +
 compose.nvidia.yaml              | 1 +
 compose.yaml                     | 1 +
 setup/charts/plus/questions.yaml | 4 ++++
 setup/charts/plus/values.yaml    | 1 +
 5 files changed, 8 insertions(+)

diff --git a/compose.intel.yaml b/compose.intel.yaml
index a063d3a58..1bce61af7 100644
--- a/compose.intel.yaml
+++ b/compose.intel.yaml
@@ -67,6 +67,7 @@ services:
       PHOTOPRISM_OIDC_URI: "https://keycloak.localssl.dev/realms/master"
       PHOTOPRISM_OIDC_CLIENT: "photoprism-develop"
       PHOTOPRISM_OIDC_SECRET: "9d8351a0-ca01-4556-9c37-85eb634869b9"
+      PHOTOPRISM_OIDC_PROMPT: ""                            # authorization prompt: login, select_account, or consent (empty = seamless SSO)
       PHOTOPRISM_OIDC_PROVIDER: "Keycloak"
       PHOTOPRISM_OIDC_REGISTER: "true"
       PHOTOPRISM_OIDC_WEBDAV: "true"
diff --git a/compose.nvidia.yaml b/compose.nvidia.yaml
index d0c078ad4..12e47f8d1 100644
--- a/compose.nvidia.yaml
+++ b/compose.nvidia.yaml
@@ -70,6 +70,7 @@ services:
       PHOTOPRISM_OIDC_URI: "https://keycloak.localssl.dev/realms/master"
       PHOTOPRISM_OIDC_CLIENT: "photoprism-develop"
       PHOTOPRISM_OIDC_SECRET: "9d8351a0-ca01-4556-9c37-85eb634869b9"
+      PHOTOPRISM_OIDC_PROMPT: ""                            # authorization prompt: login, select_account, or consent (empty = seamless SSO)
       PHOTOPRISM_OIDC_PROVIDER: "Keycloak"
       PHOTOPRISM_OIDC_REGISTER: "true"
       PHOTOPRISM_OIDC_WEBDAV: "true"
diff --git a/compose.yaml b/compose.yaml
index 917ef7e15..b4ffac2eb 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -74,6 +74,7 @@ services:
       PHOTOPRISM_OIDC_URI: "https://keycloak.localssl.dev/realms/master"
       PHOTOPRISM_OIDC_CLIENT: "photoprism-develop"
       PHOTOPRISM_OIDC_SECRET: "9d8351a0-ca01-4556-9c37-85eb634869b9"
+      PHOTOPRISM_OIDC_PROMPT: ""                            # authorization prompt: login, select_account, or consent (empty = seamless SSO)
       PHOTOPRISM_OIDC_PROVIDER: "Keycloak"
       PHOTOPRISM_OIDC_REGISTER: "true"
       PHOTOPRISM_OIDC_WEBDAV: "true"
diff --git a/setup/charts/plus/questions.yaml b/setup/charts/plus/questions.yaml
index c029c93fc..a53d4f787 100644
--- a/setup/charts/plus/questions.yaml
+++ b/setup/charts/plus/questions.yaml
@@ -206,6 +206,10 @@ questions:
         description: "Space-delimited scopes requested from the provider."
         type: string
         default: "openid email profile"
+      - variable: oidc.PHOTOPRISM_OIDC_PROMPT
+        label: "OIDC Authorization Prompt"
+        description: "Optional prompt forcing re-authentication or account selection: login, select_account, or consent."
+        type: string
       - variable: oidc.PHOTOPRISM_OIDC_REGISTER
         label: "Auto Register Users"
         description: "Automatically create PhotoPrism accounts after successful OIDC login."
diff --git a/setup/charts/plus/values.yaml b/setup/charts/plus/values.yaml
index e53e7c512..ff9dccb1c 100644
--- a/setup/charts/plus/values.yaml
+++ b/setup/charts/plus/values.yaml
@@ -94,6 +94,7 @@ oidc:
   PHOTOPRISM_OIDC_CLIENT: ""
   PHOTOPRISM_OIDC_SECRET: ""
   PHOTOPRISM_OIDC_SCOPES: "openid email profile"
+  PHOTOPRISM_OIDC_PROMPT: ""
   PHOTOPRISM_OIDC_REGISTER: true
   PHOTOPRISM_OIDC_REDIRECT: false
   PHOTOPRISM_OIDC_USERNAME: "email"