search

nginxinc / nginx-openid-connect

Reference implementation of OpenID Connect integration for NGINX Plus
https://www.nginx.com/products/nginx/
Other
199 stars 94 forks source link

Setting a state variable #47

Open LakshanKarunathilake opened 2 years ago

LakshanKarunathilake commented 2 years ago

Is there a way to pass a state variable ?

tippexs commented 2 years ago

Not without modifying the code a little bit.

https://github.com/nginxinc/nginx-openid-connect/blob/db991ecb83e1b388e1ae74bf5e16dd4a6eb4e6d0/openid_connect.js#L262

If PKCE is in use the state value is already be in use for the pkce_id value. If you are not using PKCE you could assign any other value to the state variable.

What kind of value would you like to send to the IdP in the state?

LakshanKarunathilake commented 2 years ago

I am currently using PKCE, apart from that I need to send some additional information. As you suggested, I think it would be better if we are able to pass parameters along with the request

tippexs commented 2 years ago

If it`s just about sending additional URI params to the IdP you can simply change the NGINX configuration and send them along.

https://github.com/nginxinc/nginx-openid-connect/blob/db991ecb83e1b388e1ae74bf5e16dd4a6eb4e6d0/openid_connect.server_conf#L42

Handling new params at codexch can be handled here:

https://github.com/nginxinc/nginx-openid-connect/blob/db991ecb83e1b388e1ae74bf5e16dd4a6eb4e6d0/openid_connect.server_conf#L28

Whats the usecase? This would help better to undestand where you should implement the new logic.

LakshanKarunathilake commented 2 years ago

Even if I disable the PKCE. state variable is set to default value 0 so I am unable to set the custom parameter there. I want to send a custom UUID parameter to IDP and get that parameter to redirect to the proper subdomain. IDP is only allowing the state parameter it is not accepting the custom query parameters.

LakshanKarunathilake commented 2 years ago

@tippexs If I open a PR to support customizing the state parameter and if PKCE is not enabled then use the given state parameter will that be okay ?

LakshanKarunathilake commented 2 years ago

If it`s just about sending additional URI params to the IdP you can simply change the NGINX configuration and send them along.

https://github.com/nginxinc/nginx-openid-connect/blob/db991ecb83e1b388e1ae74bf5e16dd4a6eb4e6d0/openid_connect.server_conf#L42

Handling new params at codexch can be handled here:

https://github.com/nginxinc/nginx-openid-connect/blob/db991ecb83e1b388e1ae74bf5e16dd4a6eb4e6d0/openid_connect.server_conf#L28

Whats the usecase? This would help better to undestand where you should implement the new logic.

If we want to attach new URI parameters for the codexch is it possible ?