Enable Hybrid auth flow for custom OIDC identity provider
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
### Auth forced into Authentication Code flow when Hybrid flow is required by identity provider
Using IdentityServer 4 client or any other client which requires Hybrid grant type with Authorization Code flow (`response_type=code`) will result in an `unauthorized_client` error. Auth request type should be `code id_token` (hybrid) not `code` (authorization code) as is forced when using customOpenIdConnectProviders.
**staticwebapp.config.json**
```
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"identity": {
"registration": {
"clientIdSettingName": "IS_PROVIDER_ID",
"clientCredential": {
"clientSecretSettingName": "IS_PROVIDER_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://IDENTITY_SERVER/.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile", "email", "offline_access", "role"],
"loginParameterNames": [
"response_mode=form_post"
]
}
}
}
}
}
```
I've attempted to override the response_types in the `loginParameterNames` which would consequently be removed in the actual network call.
```
"loginParameterNames": [
"response_mode=form_post",
"response_type=code+id_token"
]
```
In the above example `response_mode` is added to the request, however `response_type` is not.

**Expected behavior**
Authorization should be able to configured to use a Hybrid flow wherein `response_type=code id_token`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.