Allow configuration of custom upstream_parameters

[hugotiburtino]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

In a social login a identity provider asked us to pass a custom query parameter at login (let's say idp_hint).
It would be so simple as doing

kratos.updateLoginFlow({ 
  flow: flow.id, 
  updateLoginFlowBody: {
    ...values, 
    upstream_parameters: { idp_hint: 'foo' } 
  } 
})

but Ory Kratos currently supports only the following upstream parameters: login_hint, hd, prompt, and auth_type.

Describe your ideal solution

It would be handy to have a configuration field to allow other upstream parameters.

Workarounds or alternatives

Even simpler would be to allow any custom parameter. But of course it would mean a security risk.

Version

v1.3.0

Additional Context

No response

[aeneasr]

It should probably be fine to allow setting most parameters (except security relevant ones line state, nonce etc). What exactly are you trying to solve

[hugotiburtino]

I'm trying to solve a demand of an important partner.
They are going to redirect to our login page with a query parameter (v.g. example.org/#?idp_hint=foo). We should get the idp_hint and forward it to the Social Login after the user clicks the partner button.
It would be good to be able to do the something clean like the following:

kratos.updateLoginFlow({ 
  updateLoginFlowBody: {
    // ...
    upstream_parameters: { idp_hint: extractIdpHintFromUrl() } 
  } 
})

As it is now, we are forced to hack.

[aeneasr]

Which provider is that? We can probably add a custom provider to support this parameter

[hugotiburtino]

I will tell you privately.
But I think anyway that it would be a handy to leave it free to each developer that have to implement custom social login.

[aeneasr]

If it‘s private it doesn’t belong in an open source repository :)