eclipse-vertx / eclipse-vertx/vertx-auth

Allow specifying clientId together with clientAssertion/clientAssertionType

Closed
#713 2 comments 0 reactions 1 assignee Claimed by @tsegismont View on GitHub
enhancement help wanted
Dominant language
Java
Stars
175
Forks
159
Avg merge
6m
Merged PRs (30d)
2

Description

Currently it's only possible to either specify the `clientId` or use `clientAssertion`/`clientAssertionType`.

However some provider require the use of `clientId` together with `clientAssertion`/`clientAssertionType`
e.g. Microsoft requires a `clientId` if the certificate credential is used see: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential
and I think also keycloak requires clientId always to be present:
https://github.com/keycloak/keycloak/blob/5387aef0fa727ea5cae4816f682ec72798fabaa4/services/src/main/java/org/keycloak/protocol/oidc/endpoints/request/AuthorizationEndpointRequestParserProcessor.java#L119-L123

The code responsible for it is in:
https://github.com/eclipse-vertx/vertx-auth/blob/be9744623224e45eb8df868fa3ff23d193e98699/vertx-auth-oauth2/src/main/java/io/vertx/ext/auth/oauth2/impl/OAuth2API.java#L184-L194

I guess this could be relaxed to only check if clientSecret is null and allow both `clientId` and `clientAssertion`/`clientAssertionType`.

Happy to provide a PR for this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.