Repository navigation
Bring the API spec up to date with OAuth 2.1 support - #281
Merged
Merged
Conversation
The OpenAPI spec lagged behind the OAuth 2.1 work on master since libregraph#273: resource indicators, public clients, PKCE requirements and refresh token handling. Some of it was wrong rather than missing. It said the token response has no scope member, that code_challenge_methods_supported requires no client to send a challenge, that bare code is not advertised as a response_type, and that the token endpoint accepts only client_secret_basic or none. The spec now describes what the code does, and its version goes from 1.1.0 to 1.2.0. The info section lists RFC 8414, RFC 7636 with S256 only and RFC 8707. The authorize endpoint gains the resource parameter: a single value, normalized, which must be registered, narrows the requested scopes except openid and offline_access, and is otherwise refused with an invalid_target redirect. code_challenge states which clients must send one, dynamic clients, static clients with require_pkce and all clients under --require-pkce, and that this is enforced at the token endpoint. The POST form lists the new parameters. The token endpoint names client_secret_post besides client_secret_basic and none, and describes public clients. resource is accepted on both grants and must match, else invalid_target. A refresh may narrow scope, refused with invalid_scope otherwise, ignores redirect_uri and rotates the refresh token when offline_access was granted. The token response carries scope. The new AccessTokenClaims schema describes iss, sub, aud with a single value, azp only when the token is bound to a resource, scp as a space delimited list, exp, iat and jti, and how a resource server validates such a token. bearerAuth and the access_token of the token response refer to it. Registration documents public clients registered without a secret, PKCE required for every dynamic client, client_secret_basic as the default, client_secret_expires_at being 0 unless --dynamic-client-secret-duration is set, and 400 JSON errors with invalid_redirect_uri or invalid_client_metadata. Static registration gains require_pkce, token_endpoint_auth_method none and the new ResourceRegistration schema for the resources array, whose id is normalized at startup and used as aud, with name, scopes and implicit_scopes. OIDCError is also used by registration and its enum gains invalid_target, invalid_redirect_uri and invalid_client_metadata.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
docs/libregraph-connect-api-v1.yamlto what master does since #273. Documentation only, no code change.Some statements were wrong, not just missing:
scopemember. It always carries the granted scopes.code_challenge_methods_supportedsaid no client is required to send a challenge. Dynamically registered clients, static clients withrequire_pkce, and every client under--require-pkcemust.response_typeclaimed barecodeis not advertised. It is; only baretokenandcode tokenare accepted without being advertised.client_secret_basicornone. It also acceptsclient_secret_post.Added
Authorize
resourceparameter (RFC 8707): one value, normalized, must be registered, narrows the requested scopes exceptopenidandoffline_access, and is otherwise refused with aninvalid_targetredirect.code_challenge, and that this is enforced at the token endpoint.Token
resourceon both grants, scope narrowing on refresh withinvalid_scope,redirect_uribeing ignored on refresh, refresh token rotation, andscopein the response.Registration
client_secret_basicas the default,client_secret_expires_at: 0for a secret which does not expire, and theinvalid_redirect_uriandinvalid_client_metadataerrors.Schemas
AccessTokenClaims: the claims of an access token and how a resource server validates one.ResourceRegistration: theresourcessection ofidentifier-registration.yaml.StaticClientRegistrationgainsrequire_pkce.The spec version goes from 1.1.0 to 1.2.0.