fix: mark client_id as required in oauth2 token endpoint #421
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Required for `private_key_jwt` auth, the method of client_assertion | ||
| being sent. Only "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" | ||
| is supported. | ||
| client_id: |
There was a problem hiding this comment.
Can move this into ClientCredentialsSecret since it's not needed for private_key_jwt.
There was a problem hiding this comment.
Is it not? The field is accessed regardless of assertion type: https://github.com/snyk/oauth-token-server/blob/e3a7a1d1ad45635cea178504ad542b874b210b91/internal/authorizationserver/handler_oauth2_token.go#L52
There was a problem hiding this comment.
Ah, good point. Looks like just for logging purposes (otherwise it uses the client model directly), and I think that was added recently-ish.
Originally it worked without needing it, since the client_id is the sub on the self-signed JWT: https://github.com/snyk/service-account-oauth-demo/blob/main/03_get-access-token.py#L39-L45
The token endpoint using client_credentials flow requires a client_id, which was previously not documented. This adds that field as well as makes it clear there are two separate shapes for requests depending on the client_assertion_type.
jgresty
force-pushed
the
fix/client-id-required
branch
from
2e7a46f to
88898a9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The token endpoint using client_credentials flow requires a client_id, which was previously not documented. This adds that field as well as makes it clear there are two separate shapes for requests depending on the client_assertion_type.