Client's Alias - Githubissues

meateam / OSpike

An OAuth2 authorization server supporting OpenID Connect

MIT License

2 stars 0 forks source link

Closed yonatandt closed 4 years ago

yonatandt commented 4 years ago

The client should have an alias which is easy to understand, instead of trying to understand a random generated string.

ShragaUser commented 4 years ago

This is a definite must. Using mongo generated _id as audience property value isn't descriptive enough and is also a security risk.

Current behavior:

Returned jwt token has the property "aud" with the value of the _id requested.
Client must know the _id of the service provider in order to request Scopes and interact with provider.

Wanted behavior:

All entities should have a 'name' or 'audience' or 'alias' value that should be used as the audience value when requesting jwts and as the 'aud' property in the received jwt.

shakedmanes commented 4 years ago

Currently the audienceId is unique generated string.

I definitely agree with your suggestions.

In the next release we can easily support a way for changing the audienceId for some alias for your best usage.

Currently, if the issue is making your life difficult, I can change it personally to whatever audienceId you want :)

misha1235000 commented 4 years ago

solved in #93