Token exchange support - Githubissues

IdentityPython / oidc-op

An implementation of an OIDC Provider (OP)

Apache License 2.0

64 stars 26 forks source link

Token exchange support #165

Open ctriant opened 2 years ago

nsklikas commented 2 years ago

Run darker on this. Other than this LGTM.

@rohe @peppelinux what do you think?

rohe commented 2 years ago

Nice set of tests !

nsklikas commented 2 years ago

We merged this in our private fork, here are some things that need to be done:

Check that the new scopes are a subset of the allowed scopes for the client
Set the expires_at of the new token to be the same as the original token's. This would stop a client from getting an access token from another client and using token exchange to refresh it indefinitely.
Do we need to check whether the client using the token is allowed to do so? (in the case where the token wasn't issued for them)

peppelinux commented 2 years ago

@nsklikas we just have two conflicting files right now :)

melanger commented 2 years ago

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

ctriant commented 2 years ago

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

Hello! It is already supported in idpy-oidc. https://github.com/IdentityPython/idpy-oidc/tree/main

rohe commented 2 years ago

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

melanger commented 2 years ago

The default OIDC frontend in SATOSA uses pyop and oic, but I am using satosa-oidcop which uses this library (oidc-op).

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

So which library is the "new" one? I though it is this one.

rohe commented 2 years ago

idpy-oidc is where the action is.

melanger commented 2 years ago

idpy-oidc is where the action is.

So let me recap:

SATOSA contains OpenIDConnectFrontend based on pyop, that's an "old" one
satosa-oidcop provides OidcOpFrontend based on oidc-op (this library), which is a "less old" one
the current library is idpy-oidc, but there is no SATOSA frontend which uses the library

What are the development plans? Are you going to support oidc-op until idpy-oidc is mature enough and integrated with SATOSA?

rohe commented 2 years ago

Good questions all. I'm responsible for the OIDC/OAuth2 libraries within IdentityPython and I would like SATOSA to switch to using idpy-oidc as soon as possible. I think there is a SATOSA frontend, based on idpy-oidc, in the EduTeams implementation but it isn't public yet.