auth0 / auth0-oidc-client-net

OIDC Client for .NET Desktop and Mobile applications
https://auth0.github.io/auth0-oidc-client-net/
Apache License 2.0
84 stars 48 forks source link

Error getting configuration for JWK in Auth0.OidcClient.Tokens because of incorrect metadataAddress (/.well-known/openid-configuration) #320

Closed Jeroen-Van-Loocke closed 7 months ago

Jeroen-Van-Loocke commented 7 months ago

Checklist

Description

They GetForIssuer method in Auth0.OidcClient.Tokens.JsonWebKeys does not take into account that the address can be more than just a hostname. This means the resulting url that is used to get the .well-known/openid-configuration is not correct.

Current implemted:

public async Task<JsonWebKeySet> GetForIssuer(string issuer)
{
    var metadataAddress = new UriBuilder(issuer) { Path = "/.well-known/openid-configuration" }.Uri.OriginalString;
    var openIdConfiguration = await GetOpenIdConfiguration(metadataAddress);
    return openIdConfiguration.JsonWebKeySet;
}

Suggested:

public async Task<JsonWebKeySet> GetForIssuer(string issuer)
{
    var metadataUriBuilder = new UriBuilder(issuer.TrimEnd('/'));
    metadataUriBuilder.Path += ("/.well-known/openid-configuration");
    var openIdConfiguration = await GetOpenIdConfiguration(metadataUriBuilder.Uri.OriginalString);
    return openIdConfiguration.JsonWebKeySet;
}

Reproduction

Any login with a Domain that also contains a part of a path. For example:

var auth0Client = new Auth0Client(new Auth0ClientOptions
{
    Domain = "myidp.somedomain.com/realms/myrealmname",
    ClientId = clientId
});

Additional context

No response

auth0-oidc-client-net version

4.0.0

.NET version

All versions

Platform

Windows

Platform version(s)

All versions

frederikprijck commented 7 months ago

This SDK is designed to work with Auth0 specifically, and is nothing but a small Auth0-specific wrapper around https://github.com/IdentityModel/IdentityModel.OidcClient.

If you are not using Auth0, please use https://github.com/IdentityModel/IdentityModel.OidcClient directly.

Based on that, the way the URL is defined is intentional.