Azure / Azure/static-web-apps

Enable Hybrid auth flow for custom OIDC identity provider

Open
#591 1 comment 4 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

### Auth forced into Authentication Code flow when Hybrid flow is required by identity provider

Using IdentityServer 4 client or any other client which requires Hybrid grant type with Authorization Code flow (`response_type=code`) will result in an `unauthorized_client` error. Auth request type should be `code id_token` (hybrid) not `code` (authorization code) as is forced when using customOpenIdConnectProviders.

**staticwebapp.config.json**

```
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"identity": {
"registration": {
"clientIdSettingName": "IS_PROVIDER_ID",
"clientCredential": {
"clientSecretSettingName": "IS_PROVIDER_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://IDENTITY_SERVER/.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile", "email", "offline_access", "role"],
"loginParameterNames": [
"response_mode=form_post"
]
}
}
}
}
}
```

I've attempted to override the response_types in the `loginParameterNames` which would consequently be removed in the actual network call.
```
"loginParameterNames": [
"response_mode=form_post",
"response_type=code+id_token"
]
```
In the above example `response_mode` is added to the request, however `response_type` is not.

![image](https://user-images.githubusercontent.com/4276388/134546230-d2432440-a120-4e1d-8473-fe5987be0fc6.png)

**Expected behavior**
Authorization should be able to configured to use a Hybrid flow wherein `response_type=code id_token`

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.