Xabaril / AspNetCore.Diagnostics.HealthChecks

Enterprise HealthChecks for ASP.NET Core Diagnostics Package
Apache License 2.0
3.98k stars 771 forks source link

Fix strict OpenIdConnect server response validation #2164

Open hschink opened 4 months ago

hschink commented 4 months ago

What this PR does / why we need it:

This PR introduces a new parameter for the OpenIdConnect health check which allows to control the validation of the OpenId Provider response.

Specifically, with this PR users can enable/disable the validation of the response_types_supported parameter for Dynamic OpenID Providers. The specification states:

REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the id_token token Response Type values.

Which issue(s) this PR fixes:

2152

Special notes for your reviewer:

On my local machine test be_healthy_if_idsvr_is_available fails. I assume this is related to my local setup.

Does this PR introduce a user-facing change?:

Yes, by default the Dynamic OpenID Providers-specific validation is disabled. Current users of the validation need to activate the check explicitly.

Please make sure you've completed the relevant tasks for this PR, out of the following list:

hschink commented 4 months ago

@dotnet-policy-service agree company="Trapeze"