Table of Contents

Class UserInteractionOptions

Namespace
Fdyay.IdentityServer.Configuration
Assembly
Fdyay.IdentityServer.Core.dll

Paths the protocol endpoints redirect to for interactive login, consent and signout.

public class UserInteractionOptions
Inheritance
UserInteractionOptions
Inherited Members

Properties

AllowOriginInReturnUrl

Whether a return URL may be absolute when it names this server's own origin. Defaults to false. Duende's.

public bool AllowOriginInReturnUrl { get; set; }

Property Value

bool

Remarks

Duende 8.0.1's, measured: read by the OpenID Connect and SAML return-URL parsers, which take this server's origin off the front of an absolute return URL — compared ignoring case — and then judge what is left as they judge any other.

Ours, decided 2026-10-14: it also decides whether an interaction page configured as an absolute URL is handed an absolute return URL. Duende hands one whatever the option, so a page on this server written that way stops resuming requests until the option is on; here, off, every page is handed the relative return URL it always was.

ConsentMessageLifetime

How long a recorded consent decision can be read back. Defaults to 5 minutes.

public TimeSpan ConsentMessageLifetime { get; set; }

Property Value

TimeSpan

Remarks

Long enough for the redirect from the consent page back to the authorize endpoint, and no longer.

ConsentReturnUrlParameter

The return-url query parameter name for the consent redirect. Defaults to returnUrl.

public string ConsentReturnUrlParameter { get; set; }

Property Value

string

Remarks

Separate from the login parameter so a host can route the two redirects differently.

ConsentUrl

The consent page path. Defaults to /account/consent.

public string ConsentUrl { get; set; }

Property Value

string

CreateAccountReturnUrlParameter

The return-url query parameter name for the create-account redirect. Defaults to returnUrl. Duende's.

public string CreateAccountReturnUrlParameter { get; set; }

Property Value

string

CreateAccountUrl

The create-account page, for a request with prompt=create. Defaults to null. Duende's.

public string? CreateAccountUrl { get; set; }

Property Value

string

Remarks

Duende 8.0.1's, measured: unset, create is not among the supported prompt values and a request asking for it is refused as an unsupported prompt; set, UseIdentityServer adds create to PromptValuesSupported, so discovery publishes it and the authorize endpoint sends such a request here.

CustomRedirectReturnUrlParameter

The return-url query parameter name for a redirect an interaction generator asks for. Defaults to returnUrl. Duende's.

public string CustomRedirectReturnUrlParameter { get; set; }

Property Value

string

Remarks

Appended to InteractionResponse.RedirectUrl when a host's IAuthorizeInteractionResponseGenerator sends the user somewhere of its own before the request is answered.

ErrorIdParameter

The error-id query parameter name. Defaults to errorId.

public string ErrorIdParameter { get; set; }

Property Value

string

ErrorMessageLifetime

How long a stored error context can be read back. Defaults to 5 minutes.

public TimeSpan ErrorMessageLifetime { get; set; }

Property Value

TimeSpan

Remarks

Long enough for the redirect to the error page, short enough not to accumulate.

ErrorUrl

The error page path. Defaults to /account/error.

public string ErrorUrl { get; set; }

Property Value

string

LoginReturnUrlParameter

The return-url query parameter name for the login redirect. Defaults to returnUrl.

public string LoginReturnUrlParameter { get; set; }

Property Value

string

Remarks

Separate from the consent parameter so a host can route the two redirects differently.

LoginUrl

The login page path. Defaults to /account/login.

public string LoginUrl { get; set; }

Property Value

string

LogoutIdParameter

The logout-id query parameter name. Defaults to logoutId.

public string LogoutIdParameter { get; set; }

Property Value

string

LogoutUrl

The logout page path. Defaults to /account/logout.

public string LogoutUrl { get; set; }

Property Value

string

PromptValuesSupported

The prompt values the authorize endpoint accepts, published as prompt_values_supported. Duende's.

public ICollection<string> PromptValuesSupported { get; set; }

Property Value

ICollection<string>

Remarks

Duende 8.0.1's, measured: none, login, consent and select_account, with create added at startup when CreateAccountUrl is set. A request carrying any other value is refused (invalid_request, "Unsupported prompt mode"); until 0.142.0 an unknown value was accepted and ignored. A value added here needs an IAuthorizeInteractionResponseGenerator that acts on it.

ReturnUrlParameter

A second name the login page also accepts a return URL under. Defaults to returnUrl.

public string ReturnUrlParameter { get; set; }

Property Value

string

Remarks

No longer emitted by anything. Until 0.56.0 the SAML single sign-on endpoint used this while the authorize endpoint used LoginReturnUrlParameter — two names for one destination, which is how a host that renamed the documented one broke SAML sign-on while OIDC kept working. Both redirects now emit LoginReturnUrlParameter.

Kept, and still read, so a host that had configured only this one is not broken by the unification: the login page tries LoginReturnUrlParameter first and falls back to this. Prefer the specific one. The same shape as 0.52.0's NameIdClaimType fix — one side owns the canonical spelling and the other is an additional mapping rather than a replacement.

ShowErrorDetail

Whether the error page may show the error code, description and requested client id. Defaults to false.

public bool ShowErrorDetail { get; set; }

Property Value

bool

Remarks

Off by default so a host that configures nothing discloses nothing: end users see a generic message and the reference id only. Turn it on in environments where showing protocol detail to whoever hit the page is acceptable.