skipApprovalScreen stopped working in version 2.40.0

[xzizka]

We were using Dex 2.38.0 with the following config (anonymized).

connectors:
  - type: ldap
    name: Active Directory
    id: ad
    config:
      <multiline AD configuration>
enablePasswordDB: false
issuer: https://dex.<issuer_URL>
oauth2:
  skipApprovalScreen: true
  passwordConnector: ad
staticClients:
  - id: kubernetes-k8s
    redirectURIs:
      - 'http://localhost:8000'
      - 'http://localhost:18000'
      - 'https://localhost:8080/auth/callback'
      - '/device/callback'
      - 'https://<dashboard_url_callback>/oauth2/callback'
    name: 'Kubernetes'
    secret: <kubernetes_scret>
    public: false
  - id: argocd-k8s
    name: ArgoCD
    redirectURIs:
      - 'http://localhost:8085/auth/callback'
      - 'https://<argo_callback_url>/auth/callback'
    secret: <argo_secret>
    public: false    
storage:
  type: kubernetes
  config:
    inCluster: true
web:
  tlsCert: /<cert_path>/tls.crt
  tlsKey: /<cert_path>/tls.key

If we use it with dex:v2.38.0, the approval screen with "Grant Access" is skipped. When we upgraded to version 2.40.0 keeping the same configuration the "Grant Access" screen is not skipped and we need grant the access by clicking on the button.

I was checking these discussions:

• Unable to skip "grant access" screen while using skipApprovalScreen: true with dex version 2.39.1 #3540
• fix: Do not evaluate skipApproval on approval page #3086
• Unable to skip "grant access" screen while using skipApprovalScreen: true with dex version 2.39.1 #3540

In the last issue there was mentioned, that the issue was caused by approval_prompt=force setting, but we don't use it anywhere.

I am not sure, if I miss any config changes or if this is a bug. As it can be seen here (#3540 (comment)) I am not the only one with the issue.
In version 2.39.0 was implemented this change:
#2897
It looks the issue started with the version where the issue was implemented.

We use Dex internally and we don't need the approval screen. In our case it is annoying.
Is there any configuration, that needs to be set except the skipApprovalScreen, to disable the approval screen in version 2.40.0?

[xzizka]

Maybe one more comment.
We use Dex for authentication for K8s (for kubectl), for ArgoCD and for kubernetes Dashboard behind OAuth2Proxy.
There is no issue for kubectl and ArgoCD loggin. There is nothing like Grant Access screen. We see the issue just for the Dashboard behind the OAuth2 Proxy. I tried OAuth2 proxy version 7.3.0 and 7.6.0.
Regardless the OAuth2 proxy version the behavior (Grant Access screen) depends only on the version of Dex (no screen with 2.38.0, Grant Access screen with 2.40.0).

[nabokihms]

Hello, oauth2 proxy sets approval_prompt=force by default. You can override it with a flag.

https://github.com/oauth2-proxy/oauth2-proxy/blob/master/docs/docs/configuration/overview.md#command-line-options

--approval-prompt

[xzizka]

Thank you.
Adding the --approval-prompt=none to the OAuth2 proxy arguments in OAuth2 proxy configuration solved the issue.