Default OIDC Discovery values not set

Search terms you've used

oidc, openid, default

Impacted package

Which packages do you think might be impacted by the bug ?

• solid-client-authn-browser
• solid-client-authn-node
• solid-client-authn-core
• oidc-client-ext
• Other (please specify): ...

Bug description

When loading the OIDC Discovery data from the .well-known/openid-configuration endpoint of an Identity Provider, the solid-client-authn-core package does not seem to add some defaults of the provider metadata.

To Reproduce

1. Use a discovery configuration file with no grant_types_supported parameter.
2. Try to log in using the solid-client-authn-browser package (not tested for solid-client-authn-node), with client credentials (other flows trigger Dynamic Registration, which does not check for the left-out parameter.)

Expected result

The AggregateOidcHandler succeeds in AuthorizationCodeWithPkceOidcHandler because the grant_types_supported parameter falls back to the default.

Actual result

The AggregateOidcHandler fails, because the AuthorizationCodeWithPkceOidcHandler returns false, since there is not grant_types_supported parameter set.

Additional information

The default value for the grant_types_supported parameter should be ["authorization_code", "implicit"]. Not sure which other defaults are missing.

Start by tracing OIDC Discovery data through the solid-client-authn-core package into AggregateOidcHandler and AuthorizationCodeWithPkceOidcHandler. Compare the handled metadata with the OpenID Connect Provider Metadata defaults, then verify that a configuration without grant_types_supported allows the browser authorization-code-with-PKCE flow to succeed.