OIDC certification - Githubissues

peppelinux commented 2 years ago

Latest rohe's improvements on OIDC certification

FAPI OP example project

peppelinux commented 2 years ago

please @rohe I think that we should prune

example/flask_op/templates.tgz

peppelinux commented 2 years ago

Closes https://github.com/IdentityPython/oidc-op/pull/150

rohe commented 2 years ago

Changes that this PR accomplish:

If response_type == id_token return userinfo that normally would be returned from the userinfo endpoint in the id_token.
Don't run parse_cookie twice. One after the other.
Allow for different claims release policies to be in effect simultaneously (typically id_token+userinfo).
Error response when response_mode == form_post not handled correctly. return_uri needed.
Use extra info in ValueError exception instance to return correct error code.
Allow endpoints to have their own request verification error handler.
Having session ID in ID Token instance simplifies things.
Finding the last issued token of a specific type is useful.
Should check if client session is revoked.
Revoked all grants issued to a user/client pair.
Merged the two ClaimsInterface versions.
Removed tests using method that was removed and incomplete test.
Client registration endpoint should return a 201 HTTP response code on successful registration.
Default token lifetime should not be 0 (zero). Changed to be 30 minutes (1800 seconds).
Authorization error response MUST contain 'state' if it is present in the request.
Check cookie age.
Revoke tokens that has been minted using a code that then is used once more.
prompt==login forces re-authentication.
prompt attribute is a list.

peppelinux commented 2 years ago

@rohe we have cryptojwt 1.6.0 in pypi https://pypi.org/project/cryptojwt/

why oidcmsg doesn't work?

rohe commented 2 years ago

Hmm, have to look into it. I'll do that tomorrow.

peppelinux commented 2 years ago

yes CI fails because we need first of all the release oidcmsg 1.5.3, due to this https://github.com/IdentityPython/JWTConnect-Python-OidcMsg/pull/53

peppelinux commented 2 years ago

ok, so hopefully we'll have first the next release of oidcmsg to get oidcop CI working again. Probably we'll have in this PR also the configuration paramers for time slack

peppelinux commented 2 years ago

@rohe oidcmsg 1.5.3 just released, this CI works great it seems to me that this is ready to be merged

rohe commented 2 years ago

I think so too. Waiting for Nikos!

IdentityPython / oidc-op

OIDC certification #155