select_preferred_auth may be choosing a method for which there are not required resources

[danj3]

oidcc version

3.2.0

Erlang version

26

Elixir version

1.16

Summary

Upon upgrade from 3.1.2 to 3.2 authorization url generation broke at attempt_par (resulting in HTTP 401/Authorization failed). The default available auth methods in oidcc_auth_util.erl:add_client_authentication, when not overridden by Opts will be used, however the client is only configured with a client_secret (for use with Basic or post methods), but the result was (one of) the JWT methods.

It seems some additional client configuration is needed to use the JWT methods (only based on the 401), so does the select_preferred_auth function need to consult the client configuration to determine if a method can be used. Alternatively, is it presumed that the client must always pass preferred_auth_methods if the IDP supports all of them but the client is only configured for a subset?

This problem may be a result of some knowledge deficit of the reporter and if so offers both apologies and request for steps to remedy.

Current behavior

Client configured with client_id and client_secret for create_redirect_url will fail authorization during PAR if the IDP supports JWT methods.

How to reproduce

configure client with client_id and client_secret without a JWT for auth.

Expected behavior

If only client_secret is in the client context/config, without a client_jwks, to detect and remove jwt auth methods during selection.

[maennchen]

I'm a bit swamped at the moment.

@paulswartz Do you have some time to have a look by any chance?

[paulswartz]

I took a look, and it looks like Oidcc should be doing the right thing and bailing out of private_key_jwt if there are no keys present: https://github.com/erlef/oidcc/blob/main/src%2Foidcc_auth_util.erl#L183

@danj3 can you share any more about your configuration?

[danj3]

I will put some debugging into the function you called out and report back.

[maennchen]

@danj3 Did you figure anything out?

[maennchen]

Closing because of inactivity