search

omniauth / omniauth-okta

OAuth2 strategy for Okta
MIT License
41 stars 37 forks source link

Make authorization server configurable #9

Closed hectron closed 4 years ago

hectron commented 4 years ago

Problem

I ran into the issue where I have multiple authorization servers in Okta and did not use the default authorization server.

OmniAuth::Strategies::Okta hard codes the userinfo endpoint to the default authorization server. Additionally, it tries to use the base URL authorization server to decode the JWT, as well as determine the audience (e.g. http://my-okta-url/oauth2/v1 as opposed to http://my-okta-url/oauth2/<custom or default>/v1. The default audience is api://default.)

Proposal

Add some configuration to allow us to support more than just the default authorization server, and also remove any kind of hard-coded endpoints.

hectron commented 4 years ago

Any thoughts on merging this, @dandrews ?

dandrews commented 4 years ago

Thanks @hectron - the PR is much appreciated