From 04a75bd33bb0c9f251169d44a36d4ce905f4c454 Mon Sep 17 00:00:00 2001
From: vjalili <jalili.vahid@gmail.com>
Date: Mon, 17 Sep 2018 09:41:29 -0700
Subject: [PATCH 1/3] Change default prompt option for Google OIDC IdP.

---
 config/oidc_backends_config.xml.sample | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/oidc_backends_config.xml.sample b/config/oidc_backends_config.xml.sample
index 98df83934f0..fc997f1b80a 100644
--- a/config/oidc_backends_config.xml.sample
+++ b/config/oidc_backends_config.xml.sample
@@ -5,7 +5,7 @@
         <client_secret> ... </client_secret>
         <redirect_uri>http://localhost:8080/authnz/google/callback</redirect_uri>
 
-        <!-- <prompt>select_account</prompt> -->
+        <prompt>consent</prompt>
         <!--The value of this parameter (i.e., prompt) specifies whether the Google authorization server should prompt
          a galaxy user for (re)authorization and consent. The possible values are: `none`, `consent`, and
          `select_account`. HOWEVER, DO NOT USE `none`, because it will cause authentication failure for new users.

From 56fb283d9b366d9d1224e0402409d31e011057db Mon Sep 17 00:00:00 2001
From: vjalili <jalili.vahid@gmail.com>
Date: Mon, 17 Sep 2018 10:43:49 -0700
Subject: [PATCH 2/3] Add a comment on why user does not see a consent screen
 with Google.

---
 config/oidc_backends_config.xml.sample | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/config/oidc_backends_config.xml.sample b/config/oidc_backends_config.xml.sample
index fc997f1b80a..665843b2eb8 100644
--- a/config/oidc_backends_config.xml.sample
+++ b/config/oidc_backends_config.xml.sample
@@ -14,6 +14,11 @@
 
          If you want the consent screen to be shown to the new users only, and re-authorization happen without
          asking for user's consent, then remove this attribute.
+
+         NOTE: Galaxy sets OIDC 'scope' (requested scope of access to user's account) to `openid`. This is the
+         minimum scope value that request only user's email address and profile name. For login process Galaxy
+         does not need any more information, hence we request minimum possible information. By design, Google
+         does NOT show consent screen for this scope, hence user only see's a login page.
         -->
     </provider>
 </OIDC>

From 5a784890de81c9a0408ddea6623ed51a0ff761aa Mon Sep 17 00:00:00 2001
From: vjalili <jalili.vahid@gmail.com>
Date: Mon, 17 Sep 2018 10:56:38 -0700
Subject: [PATCH 3/3] Update a comment in the default config of OIDC backends.

---
 config/oidc_backends_config.xml.sample | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/oidc_backends_config.xml.sample b/config/oidc_backends_config.xml.sample
index 665843b2eb8..eee3c02daf2 100644
--- a/config/oidc_backends_config.xml.sample
+++ b/config/oidc_backends_config.xml.sample
@@ -18,7 +18,8 @@
          NOTE: Galaxy sets OIDC 'scope' (requested scope of access to user's account) to `openid`. This is the
          minimum scope value that request only user's email address and profile name. For login process Galaxy
          does not need any more information, hence we request minimum possible information. By design, Google
-         does NOT show consent screen for this scope, hence user only see's a login page.
+         does NOT show consent screen for this scope, hence user will only see a login page when they try to
+         login to Galaxy using their Google account.
         -->
     </provider>
 </OIDC>