Skip to content

Improve OpenIdConfiguration model #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Improve OpenIdConfiguration model #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/app/(pages)/clients/[client]/components/Form/tabs/GrantTypes/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ export default async function GrantTypes(props: Readonly<GrantTypesProps>) {
const openIdConfiguration = await fetchOpenIdConfiguration();
const active_grant_types = props.grant_types ?? [];
const { grant_types_supported } = openIdConfiguration;
const grant_types = grant_types_supported.map(gt => {
const grant_types = (
grant_types_supported ?? ["authorization_code", "implicit"]
Copy link
Collaborator

@jacogasp jacogasp Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With new client creation page we want to support only one grant type at the time, as mutual exclusive option.
Even though the grant types field is a list, it must be exactly one element long.

Copy link
Collaborator

@jacogasp jacogasp Oct 14, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry my fault, I thought it was related to the client creation but we are talking about the client editing/visualization.
I'm not sure if we want to add not one, but two fallback options in case the backend provides no supported grant type from the well known endpoint.
In any case, if I remember correctly, we don't want to support implicit credential
@giacomini @enricovianello

Copy link
Collaborator Author

@expuss2000 expuss2000 Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They're just the fallback values in case the list of grant_types_supported is not returned in the /.well-known/openid-configuration (actually I think IAM always returns it). The specifications says that in case of omission these are the default values. In case it's not wanted to support the implicit grant type, it's up to the backend to return the correct list in the .well-known.
Just to be clear, these fallback values are not actually used because IAM specify grant_types_supported, they are added just to make TypeScript happy.

Copy link
Collaborator

@jacogasp jacogasp Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that implicit must be removed from the well known (that's tautological), but still I do not understand why we want to hardcode the implicit fallback value if don't want to support it at all. Ok to make TypeScript happy, but I think it will be happy also without the implicit value :D

Copy link
Collaborator Author

@expuss2000 expuss2000 Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be adhere to the specs. In case in the future a IAM deployment decides to use the default list of grant_types_supported and so does not explicit it in .well-known (this will probably never happen).

).map(gt => {
return {
name: gt,
value: !!active_grant_types.find(current => current === gt),
Expand Down
4 changes: 3 additions & 1 deletion src/app/(pages)/clients/new/Form/OIDCSettings/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,9 @@ export default function OIDCSettings(props: Readonly<OIDCSettingsProps>) {
<AuthenticationFlow onStatusChange={setAuthFlowFulfilled} />
<ClientAuthentication
onStatusChange={setClientAuthFulfilled}
tokenEndpointAuthMethods={token_endpoint_auth_methods_supported}
tokenEndpointAuthMethods={
token_endpoint_auth_methods_supported ?? ["client_secret_basic"]
}
/>
<Field>
<Label>Scopes</Label>
Expand Down
77 changes: 48 additions & 29 deletions src/models/openid-configuration.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,53 @@
export interface OpenIdConfiguration {
request_parameter_supported: boolean;
introspection_endpoint: string;
claims_parameter_supported: boolean;
scim_endpoint: string;
scopes_supported: string[];
userinfo_encryption_enc_values_supported: string[];
id_token_encryption_enc_values_supported: string[];
request_object_encryption_enc_values_supported: string[];
device_authorization_endpoint: string;
userinfo_signing_alg_values_supported: string[];
claims_supported: string[];
op_policy_uri: string;
claim_types_supported: string[];
token_endpoint_auth_methods_supported: string[];
// OpenID Provider Metadata
// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
issuer: string;
authorization_endpoint: string;
token_endpoint: string;
response_types_supported: string[];
request_uri_parameter_supported: boolean;
userinfo_encryption_alg_values_supported: string[];
grant_types_supported: string[];
revocation_endpoint: string;
userinfo_endpoint: string;
op_tos_uri: string;
token_endpoint_auth_signing_alg_values_supported: string[];
require_request_uri_registration: boolean;
code_challenge_methods_supported: string[];
id_token_encryption_alg_values_supported: string[];
userinfo_endpoint?: string; // Recommended
jwks_uri: string;
subject_types_supported: string[];
registration_endpoint?: string; // Recommended
scopes_supported?: string[]; // Recommended
response_types_supported: string[];
response_modes_supported?: string[];
grant_types_supported?: string[];
acr_values_supported?: string[];
subject_types_supported?: string[];
id_token_signing_alg_values_supported: string[];
registration_endpoint: string;
request_object_signing_alg_values_supported: string[];
request_object_encryption_alg_values_supported: string[];
id_token_encryption_alg_values_supported?: string[];
id_token_encryption_enc_values_supported?: string[];
userinfo_signing_alg_values_supported?: string[];
userinfo_encryption_alg_values_supported?: string[];
userinfo_encryption_enc_values_supported?: string[];
request_object_signing_alg_values_supported?: string[];
request_object_encryption_alg_values_supported?: string[];
request_object_encryption_enc_values_supported?: string[];
token_endpoint_auth_methods_supported?: string[];
token_endpoint_auth_signing_alg_values_supported?: string[];
display_values_supported?: string[];
claim_types_supported?: string[];
claims_supported?: string[]; // Recommended
service_documentation?: string;
claims_locales_supported?: string[];
ui_locales_supported?: string[];
claims_parameter_supported?: boolean;
request_parameter_supported?: boolean;
request_uri_parameter_supported?: boolean;
require_request_uri_registration?: boolean;
op_policy_uri?: string;
op_tos_uri?: string;

// OAuth 2.0 Authorization Server Metadata
// https://www.rfc-editor.org/rfc/rfc8414#section-2
revocation_endpoint?: string;
introspection_endpoint?: string;
code_challenge_methods_supported?: string[];

// OAuth 2.0 Device Authorization Grant
// https://www.rfc-editor.org/rfc/rfc8628#section-4
device_authorization_endpoint?: string;

// OpenID Connect Profile for SCIM Services Discovery Metadata
// https://openid.net/specs/openid-connect-scim-profile-1_0.html#rfc.section.2.1
scim_endpoint?: string; // Recommended
}