Support OAuth2 dynamic client registration (RFC 7591)

go-fed / apcore

Golang ActivityPub Server Framework

GNU Affero General Public License v3.0

104 stars 10 forks source link

Support OAuth2 dynamic client registration (RFC 7591) #51

Open cjslep opened 3 years ago

cjslep commented 3 years ago

Manually registering clients only makes sense for monolithic OAuth2 service providers that want to manage something like developer accounts. Since that's not what apcore apps are about, we need to support RFC 7591 OAuth 2.0 Dynamic Client Registration Protocol.

See https://github.com/go-oauth2/oauth2/issues/167.

cjslep commented 3 years ago

This is "done" for the first-party credentials.

aschrijver commented 3 years ago

AFAICS this is done by forking go-auth2 and merging in remote tracking branch https://github.com/thegrumpylion/oauth2/tree/pkce

aschrijver commented 3 years ago

I looked at the Go-AP project Fedibox, and here they are using another OAuth2 project that may be a better candidate for apcore to use (more contributors, more forks, most recently updated, part of production-ready Kubernetes-friendly Openshift distro). See:

cjslep commented 3 years ago

Thanks! I will have to take a look at that.