Issue with Dynamic Parameters in IDP Requests

[Manchiz]

Describe the issue:
Dynamic parameters specified in the Additional Query Parameters and Scope fields within the IDP configuration (Identity Providers > OAuth2/OpenID Connect Configuration > OAuth2/OpenID Connect Configuration) are not passed to the IDP request during MFA scenarios. This occurs because these parameters are not included in the redirection URL to the IDP[1] after the first step is completed. However, these dynamic values are correctly mapped and passed when the IDP is configured as the first step.

How to reproduce:

1. Configure the IDP as the second step, with Basic Authentication as the first step.

2. Add ${idpreqparam} to both Additional Query Parameters and Scope in the IDP configuration.

3. Initiate the request with the following example URL (replace <client-ID> and <callback-url>):

https://localhost:9443/oauth2/authorize?response_type=code&client_id=<client -ID>&scope=openid+openid+SYSTEM+idpreqparam=testparam&redirect_uri=<callback-url>&response_mode=form_post&code_challenge_method=S256&code_challenge=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&state=request_0

4. Use a network tracer to inspect the parameters and scope in the IDP request.

5. When the IDP is configured as the second step, the dynamic parameters are not present in the IDP request.

6. When the IDP is configured as the first step, the dynamic parameters are correctly included in the request.

Expected behavior:
Dynamic additional query parameters should be mapped and passed correctly to the IDP request, regardless of whether the IDP is configured as the first or second step.

Environment information

• Product Version: 6.1

[1]. https://github.com/wso2-extensions/identity-outbound-auth-oidc/blob/b6eb4bac768d58575c80bd8b2d9f4d4a92af740a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java#L1175C20-L1175C21