search

coreos / go-oidc

A Go OpenID Connect client.
Apache License 2.0
1.92k stars 393 forks source link

Allow the use of Pushed Authentication Requests when supported by the provider #409

Open istyf opened 8 months ago

istyf commented 8 months ago

I would like to be able to use PAR with go-oidc, but sadly it does not seem to support that. See https://datatracker.ietf.org/doc/html/rfc9126 and https://medium.com/oauth-2/pushed-authorization-requests-draft-adopted-by-oauth-working-group-a1060007150f

I am willing to take a stab at implementing support for this, unless someone is already working on it.

ericchiang commented 8 months ago

Do you have a sense of what API additions would be needed from go-oidc to support this? Briefly looking at the spec, it seems like this might be more suitable as a golang.org/x/oauth2 feature?

istyf commented 8 months ago

Thank you for your quick response! I must admit I had not given the actual implementation much thought before posting the issue, but you are right, after some more digging it seems that most of the implementation belongs in golang.org/x/oauth2.

I think though that we would like to extract the endpoint URL from the pushed_authorization_request_endpoint in the auth server metadata (here https://github.com/coreos/go-oidc/blob/6d6be43e852de391805e5a5bc14146ba3cdd4195/oidc/oidc.go#L230) and return it when we query the provider for endpoints (here https://github.com/coreos/go-oidc/blob/6d6be43e852de391805e5a5bc14146ba3cdd4195/oidc/oidc.go#L283). But ... that would require that support for this endpoint has already made it into oauth2.Endpoint so I guess I will have to start over there.

ericchiang commented 8 months ago

Thanks for the reply! Any additional metadata endpoints can be retrieved through https://pkg.go.dev/github.com/coreos/go-oidc/v3/oidc#Provider.Claims

(We should really have a better name for that method)