eclipse-vertx / eclipse-vertx/vertx-auth
Allow specifying clientId together with clientAssertion/clientAssertionType
- Dominant language
- Java
- Stars
- 175
- Forks
- 159
- Avg merge
- 6m
- Merged PRs (30d)
- 2
Description
Currently it's only possible to either specify the `clientId` or use `clientAssertion`/`clientAssertionType`.
However some provider require the use of `clientId` together with `clientAssertion`/`clientAssertionType`
e.g. Microsoft requires a `clientId` if the certificate credential is used see: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential
and I think also keycloak requires clientId always to be present:
https://github.com/keycloak/keycloak/blob/5387aef0fa727ea5cae4816f682ec72798fabaa4/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthorizationEndpointRequestParserProcessor.java#L119-L123
The code responsible for it is in:
https://github.com/eclipse-vertx/vertx-auth/blob/be9744623224e45eb8df868fa3ff23d193e98699/vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/impl/OAuth2API.java#L184-L194
I guess this could be relaxed to only check if clientSecret is null and allow both `clientId` and `clientAssertion`/`clientAssertionType`.
Happy to provide a PR for this.
Contributor guide
Assessment
This issue has not been assessed yet.