From e8a716273e0c9cd91df765aa43719ac9a87812df Mon Sep 17 00:00:00 2001
From: Martin Gross <gross@rami.io>
Date: Wed, 29 Jan 2025 11:55:12 +0100
Subject: [PATCH] OIDC: Allow to add query parameters to Authorization UR

---
 src/pretix/base/customersso/oidc.py   | 16 ++++++++++++++++
 src/pretix/control/forms/organizer.py |  9 +++++++++
 2 files changed, 25 insertions(+)

diff --git a/src/pretix/base/customersso/oidc.py b/src/pretix/base/customersso/oidc.py
index cb3a6d20d..15946caa8 100644
--- a/src/pretix/base/customersso/oidc.py
+++ b/src/pretix/base/customersso/oidc.py
@@ -139,6 +139,17 @@ def oidc_validate_and_complete_config(config):
                 )
             )
 
+    if "query_parameters" in config and config["query_parameters"]:
+        for qp in config["query_parameters"].split("&"):
+            # Very rudimentary check to avoid the most common footguns:
+            # - No ? in the query parameters
+            # - Max of one = (to split key and value)
+            # - One key, one value. Not just keys with no value.
+            if not (qp.count('=') == 1 and qp.count('?') == 0 and len(list(filter(None, qp.split('=')))) == 2):
+                raise ValidationError(
+                    _(f'Query parameter {qp} is invalid.')
+                )
+
     config['provider_config'] = provider_config
     return config
 
@@ -154,6 +165,11 @@ def oidc_authorize_url(provider, state, redirect_uri):
         'state': state,
         'redirect_uri': redirect_uri,
     }
+
+    if "query_parameters" in provider.configuration and provider.configuration["query_parameters"]:
+        for qp in provider.configuration["query_parameters"].split("&"):
+            params[qp.split("=")[0]] = qp.split("=")[1]
+
     return endpoint + '?' + urlencode(params)
 
 
diff --git a/src/pretix/control/forms/organizer.py b/src/pretix/control/forms/organizer.py
index 8a4082e86..cf2f24f8b 100644
--- a/src/pretix/control/forms/organizer.py
+++ b/src/pretix/control/forms/organizer.py
@@ -1043,6 +1043,15 @@ class SSOProviderForm(I18nModelForm):
         label=pgettext_lazy('sso_oidc', 'Phone field'),
         required=False,
     )
+    config_oidc_query_parameters = forms.CharField(
+        label=pgettext_lazy('sso_oidc', 'Query parameters'),
+        help_text=pgettext_lazy('sso_oidc', 'Optional query parameters, that will be added to calls to '
+                                            'the authorization endpoint. Enter as: {example}'.format(
+                                                example='<code>param1=value1&amp;param2=value2</code>'
+                                            ),
+                                ),
+        required=False,
+    )
 
     class Meta:
         model = CustomerSSOProvider