goauthentik / goauthentik/authentik
OAuth2/OIDC add support for private_key_jwt
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Is your feature request related to a problem?
It seems like when creating an oidc provider, the only auth method available `client_secret`. While this works great for home labs and other social providers, It would be nice to support the much stronger auth `private_key_jwt`. This is defined in more detail here:
- [OpenID Connect 1.0 spec](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
- [RFC-7523](https://www.rfc-editor.org/rfc/rfc7523.html) (OAuth2)
Many other OIDC servers support this already (Ory-Hydra, KeyCloak, authelia). Would this be something you are interested in adding support for? This would have the great benefit of not having to rotate `cllient_secret` anymore and perhaps would attract more enterprise customers?
### Describe the solution you'd like
I'd like authentik to support `private_key_jwt` as al alternative to `client_secret`
### Describe alternatives that you've considered
using `client_secret`
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.