Make token endpoint configurable and align with OIDC #292
Conversation
This patch makes the token endpoint configurable and anligns the request with the requirements with OIDC/OAUTH * https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1 * https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint Signed-off-by: Micke Nordin <[email protected]>
|
I think the schema of the token response is missing? |
Should be here, right: Line 869 in 24b3858 |
|
This looks good, don't we also want to explicitly say that the token endpoint is expected to be "just OIDC"? Or what would make it different from a vanilla OIDC token endpoint? |
|
I think the difference is that there is supposed to be an authorize step before, that we skip, that is what will get you the refresh token. |
| redirect_uri: | ||
| type: string | ||
| description: URI to redirect to after the token is issued | ||
| example: https://receiver.org/ocm/callback |
There was a problem hiding this comment.
I guess the callback is not required to be served from the /ocm "namespace", as it's a regular OIDC callback?
|
I think I/we need to look in to https://datatracker.ietf.org/doc/html/rfc6749 more, it feels unclear to me at this point, exactly which flow we should use. |
Co-authored-by: Giuseppe Lo Presti <[email protected]>
Co-authored-by: Giuseppe Lo Presti <[email protected]>
This patch makes the token endpoint configurable and anligns the request with the requirements with OIDC/OAUTH