search

panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

Get array of audiance #280

Closed RaynDol closed 4 years ago

RaynDol commented 4 years ago

HI,

We are starting using this repository for OIDC scenario which works well, we are using it with passport. We have only one issue that we define own our side two audience and we are getting only one in the client during runtime(we suppose to get an array), any idea what could be the reason ?

we define one aud and one azp https://github.com/panva/node-openid-client/blob/master/lib/client.js#L899

panva commented 4 years ago

That has nothing to do with the client tho. It’s only validating whatever the IdP returns according to the spec.

RaynDol commented 4 years ago

After a long debug session, the code expect to get the azp when there is more than one aud , why? our idp doesnt return it, is it a must according to the spec? is there any reference ?

https://github.com/panva/node-openid-client/blob/master/lib/client.js#L900

panva commented 4 years ago

https://openid.net/specs/openid-connect-core-1_0.html, search for “azp”, it is required when “aud” contains multiple values.

RaynDol commented 4 years ago

I guess you are talking on step 4 under token validation section ?

  1. If the ID Token contains multiple audiences, the Client SHOULD verify that an azp Claim is present.