Add support for code_challenge_methods_supported #408
Conversation
This is required if an RP wants to use PKCE, but doesn't know whether the provider supports the code challenge or not.
There was a problem hiding this comment.
Provider.Claims() already lets you access the OpenID Connect metadata
https://pkg.go.dev/github.com/coreos/go-oidc/v3/oidc#Provider.Claims
Also, what spec is this from and what providers implement this? I'm not seeing it the discovery spec:
https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
I may be missing something, but the added code doesn't actually appear to be used anywhere through the public APIs? E.g. codeChallengeMethods is assigned but never read or exported. Is this part of some larger change?
|
This is from the Rfc 8414 https://www.rfc-editor.org/rfc/rfc8414.html (missed that this is not a part of the oidc spec). |
|
Thanks! For what it's worth, I think adding support for supplementary specs is great. I'd just want to figure out if there's any additional API we can present more than parsing the string. E.g. what we do for the at_hash support or device authorization #365 |
This is required if an RP wants to use PKCE, but doesn't know whether the provider supports the code challenge or not.