Closed RaynDol closed 4 years ago
That has nothing to do with the client tho. It’s only validating whatever the IdP returns according to the spec.
After a long debug session, the code expect to get the azp
when there is more than one aud , why? our idp doesnt return it, is it a must according to the spec? is there any reference ?
https://github.com/panva/node-openid-client/blob/master/lib/client.js#L900
https://openid.net/specs/openid-connect-core-1_0.html, search for “azp”, it is required when “aud” contains multiple values.
I guess you are talking on step 4 under token validation section ?
HI,
We are starting using this repository for OIDC scenario which works well, we are using it with passport. We have only one issue that we define own our side two audience and we are getting only one in the client during runtime(we suppose to get an array), any idea what could be the reason ?
we define one
aud
and oneazp
https://github.com/panva/node-openid-client/blob/master/lib/client.js#L899