You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Upon upgrade from 3.1.2 to 3.2 authorization url generation broke at attempt_par (resulting in HTTP 401/Authorization failed). The default available auth methods in oidcc_auth_util.erl:add_client_authentication, when not overridden by Opts will be used, however the client is only configured with a client_secret (for use with Basic or post methods), but the result was (one of) the JWT methods.
It seems some additional client configuration is needed to use the JWT methods (only based on the 401), so does the select_preferred_auth function need to consult the client configuration to determine if a method can be used. Alternatively, is it presumed that the client must always pass preferred_auth_methods if the IDP supports all of them but the client is only configured for a subset?
This problem may be a result of some knowledge deficit of the reporter and if so offers both apologies and request for steps to remedy.
Current behavior
Client configured with client_id and client_secret for create_redirect_url will fail authorization during PAR if the IDP supports JWT methods.
How to reproduce
configure client with client_id and client_secret without a JWT for auth.
Expected behavior
If only client_secret is in the client context/config, without a client_jwks, to detect and remove jwt auth methods during selection.
The text was updated successfully, but these errors were encountered:
oidcc version
3.2.0
Erlang version
26
Elixir version
1.16
Summary
Upon upgrade from 3.1.2 to 3.2 authorization url generation broke at attempt_par (resulting in HTTP 401/Authorization failed). The default available auth methods in oidcc_auth_util.erl:add_client_authentication, when not overridden by Opts will be used, however the client is only configured with a client_secret (for use with Basic or post methods), but the result was (one of) the JWT methods.
It seems some additional client configuration is needed to use the JWT methods (only based on the 401), so does the select_preferred_auth function need to consult the client configuration to determine if a method can be used. Alternatively, is it presumed that the client must always pass preferred_auth_methods if the IDP supports all of them but the client is only configured for a subset?
This problem may be a result of some knowledge deficit of the reporter and if so offers both apologies and request for steps to remedy.
Current behavior
Client configured with client_id and client_secret for create_redirect_url will fail authorization during PAR if the IDP supports JWT methods.
How to reproduce
configure client with client_id and client_secret without a JWT for auth.
Expected behavior
If only client_secret is in the client context/config, without a client_jwks, to detect and remove jwt auth methods during selection.
The text was updated successfully, but these errors were encountered: