This changes removes the requirement of the openid scope to be set for all token requests.
As this library also support OAuth2-only authentication mechanisms we still want to sanitize requested scopes, but not enforce the openid scope.
Related to https://github.com/zitadel/zitadel/discussions/8068
This change requires an additional argument to the op.RegisterLegacyServer constructor which passes the Authorize Callback Handler.
This allows implementations to use their own handler instead of the one provided by the package.
The current handler is exported for legacy behavior.
This change is not considered breaking, as RegisterLegacyServer is flagged experimental.
Related to https://github.com/zitadel/zitadel/issues/6882
This change updates to go-jose v4, which was a new major release.
jose.ParseSigned now expects the supported signing algorithms to be passed, on which we previously did our own check. As they use a dedicated type for this, the slice of string needs to be converted. The returned error also need to be handled in a non-standard way in order to stay compatible.
For OIDC v4 we should use the jose.SignatureAlgorithm type directly and wrap errors, instead of returned static defined errors.
Closes#583
For impersonation token exchange we need to persist the actor throughout token requests, including refresh token.
This PR adds the optional TokenActorRequest interface which allows to pass such actor.
* feat(op): Add response_mode: form_post
* Fix to parse the template ahead of time
* Fix to render the template in a buffer
* Remove unnecessary import
* Fix test
* Fix example client setting
* Make sure the client not to reuse the content of the response
* Fix error handling
* Add the response_mode param
* Allow implicit flow in the example app
* feat(rp): allow form_post in code exchange callback handler
---------
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
This change adds Go 1.22 as a build target and drops support for Go 1.20 and older. The golang.org/x/exp/slog import is migrated to log/slog.
Slog has been part of the Go standard library since Go 1.21. Therefore we are dropping support for older Go versions. This is in line of our support policy of "the latest two Go versions".
* feat(op): split the access and ID token hint verifiers
In zitadel we require different behaviors wrt public key expiry between access tokens and ID token hints.
This change splits the two verifiers in the OP.
The default is still based on Storage and passed to both verifier fields.
* add new options to tests
* fix: allow expired ID token hint to end sessions
This change adds a specific error for expired ID Token hints, including too old "issued at" and "max auth age".
The error is returned VerifyIDTokenHint so that the end session handler can choose to ignore this error.
This fixes the behavior to be in line with [OpenID Connect RP-Initiated Logout 1.0, section 4](https://openid.net/specs/openid-connect-rpinitiated-1_0.html#ValidationAndErrorHandling).
* Tes IDTokenHintExpiredError
* Add configurable CORS policy in OpenIDProvider
* Add configurable CORS policy to Server
* remove duplicated CORS middleware
* Allow nil CORS policy to be set to disable CORS middleware
* create a separate handler on webServer so type assertion works in tests
As introspection is a Oauth mechanism for resource servers only,
it does not make sense to get an oidc client by ID.
The original OP did not do this and now we make the server behavior similar.
This PR replaces all occurances of interface{} with any to be consistent and improve readability.
* example: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* pkg/client: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* pkg/crypto: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* pkg/http: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* pkg/oidc: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* pkg/op: Replace `interface{}` with `any`
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
---------
Signed-off-by: Thomas Hipp <thomashipp@gmail.com>
* first draft of a new server interface
* allow any response type
* complete interface docs
* refelct the format from the proposal
* intermediate commit with some methods implemented
* implement remaining token grant type methods
* implement remaining server methods
* error handling
* rewrite auth request validation
* define handlers, routes
* input validation and concrete handlers
* check if client credential client is authenticated
* copy and modify the routes test for the legacy server
* run integration tests against both Server and Provider
* remove unuse ValidateAuthRequestV2 function
* unit tests for error handling
* cleanup tokenHandler
* move server routest test
* unit test authorize
* handle client credentials in VerifyClient
* change code exchange route test
* finish http unit tests
* review server interface docs and spelling
* add withClient unit test
* server options
* cleanup unused GrantType method
* resolve typo comments
* make endpoints pointers to enable/disable them
* jwt profile base work
* jwt: correct the test expect
---------
Co-authored-by: Livio Spring <livio.a@gmail.com>
* feat(op): user slog for logging
integrate with golang.org/x/exp/slog for logging.
provide a middleware for request scoped logging.
BREAKING CHANGES:
1. OpenIDProvider and sub-interfaces get a Logger()
method to return the configured logger;
2. AuthRequestError now takes the complete Authorizer,
instead of only the encoder. So that it may use its Logger() method.
3. RequestError now takes a Logger as argument.
* use zitadel/logging
* finish op and testing
without middleware for now
* minimum go version 1.19
* update go mod
* log value testing only on go 1.20 or later
* finish the RP and example
* ping logging release
* chore(op): reproduce issue #415
* fix(op): omit empty state from code flow redirect
Add test cases to reproduce the original bug, and it's resolution.
closes#415
