goauthentik / goauthentik/authentik

OAuth2/OIDC add support for private_key_jwt

Open
#18,762 0 comments 4 reactions 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Is your feature request related to a problem?

It seems like when creating an oidc provider, the only auth method available `client_secret`. While this works great for home labs and other social providers, It would be nice to support the much stronger auth `private_key_jwt`. This is defined in more detail here:

- [OpenID Connect 1.0 spec](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
- [RFC-7523](https://www.rfc-editor.org/rfc/rfc7523.html) (OAuth2)

Many other OIDC servers support this already (Ory-Hydra, KeyCloak, authelia). Would this be something you are interested in adding support for? This would have the great benefit of not having to rotate `cllient_secret` anymore and perhaps would attract more enterprise customers?

### Describe the solution you'd like

I'd like authentik to support `private_key_jwt` as al alternative to `client_secret`

### Describe alternatives that you've considered

using `client_secret`

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.