What happened?

Describe the bug

Joomla 6.2.0 always adds prompt=consent to the OAuth2 authorization request when configuring SMTP authentication.

This causes problems with Microsoft 365 / Microsoft Entra ID when the application is configured to require user assignment.

Even if an administrator has already granted tenant-wide consent for all required API permissions, Microsoft continues to request administrator approval when a regular user attempts to authorize the application.

The issue occurs because prompt=consent explicitly forces a new consent request instead of allowing Microsoft to reuse the existing administrator consent.

Steps to reproduce

1. Install Joomla 6.2.0.
2. Register a single-tenant application in Microsoft Entra ID.
3. Configure the delegated OAuth2 permissions SMTP.Send and offline_access.
4. Grant tenant-wide administrator consent for the required permissions.
5. Under Enterprise Applications, set Assignment required to Yes.
6. Assign a regular Microsoft 365 user to the application.
7. Configure SMTP OAuth2 authentication in Joomla using the Microsoft Entra application.
8. Start the OAuth2 authorization process using the assigned user.

Version

6.2

Expected result

The assigned user should be able to authorize the application without additional administrator approval because the required permissions have already been approved by an administrator.

Actual result

Microsoft displays an administrator approval request even though tenant-wide administrator consent has already been granted.

The OAuth2 authorization URL generated by Joomla contains:

prompt=consent

This forces Microsoft to request consent again. Even if administrator consent has been granted and user wants to re-call token request, a new consent request starts; so token could not be issued.

System Information

Joomla version: 6.2.0
OAuth2 provider: Microsoft Entra ID (single tenant)
Mail service: Microsoft 365 / Exchange Online SMTP
OAuth2 scope: https://outlook.office.com/SMTP.Send offline_access
Enterprise application setting: Assignment required = Yes
Administrator consent: Already granted for all required permissions

Microsoft also documents that explicitly passing prompt=consent can cause repeated consent errors:

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-prompt

Relevant Joomla source:
https://github.com/joomla/joomla-cms/blob/6.2.0/administrator/components/com_config/src/Controller/MailController.php#L296-L305

Additional Comments

Root cause

In Joomla 6.2.0, the following file contains hardcoded OAuth2 request parameters:

administrator/components/com_config/src/Controller/MailController.php

Inside the createOAuth2Client() method:

$requestParams = [
    'response_mode' => 'query',
    'prompt'        => 'consent',
    'access_type'   => 'offline',
];

The prompt=consent parameter is applied to all OAuth2 providers, regardless of whether it is required or appropriate.

Tested workaround

Removing the following line:

'prompt' => 'consent',

immediately resolves the problem.

After removing this parameter, the assigned Microsoft 365 user can successfully authorize Joomla without requesting administrator approval again.

This has been tested successfully with Joomla 6.2.0 and Microsoft Entra ID.

Suggested solution

The prompt=consent parameter should not be unconditionally included in OAuth2 authorization requests.

Possible solutions:

1. Remove prompt=consent from the default OAuth2 request parameters.
2. Make the prompt parameter configurable.
3. Allow provider-specific OAuth2 request parameters so that Microsoft 365 and other providers can use their appropriate authorization behavior.

In particular, existing administrator consent should be respected when using Microsoft Entra ID with restricted enterprise application access.