solid / solid/solid-oidc

Means for authenticating on /token endpoint

Open
#44 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

primer
Dominant language
Bikeshed
Stars
26
Forks
14
PR merge metrics
No merged PRs in 30d

Description

I was confused by 14. Token request with code and code verifier. So far none of the Solid pod issuers I've tried seem to require a DPoP header for a /token endpoint request.

So far, what's working for me is to use the client_secret_basic method in the request header, and not including a DPoP header. This is working for issuers:

"https://inrupt.net"

"https://solidcommunity.net"

"https://broker.pod.inrupt.com"

Quite possibly this a function of issuers catching up with standards. But it took me quite a while to figure this out. And I'd rather others didn't have to go down this rabbit hole. Perhaps there could be some language about this?

See also https://forum.solidproject.org/t/the-use-of-dpop-in-the-token-endpoint/4664/6

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the linked “Token request with code and code verifier” section in the Solid OIDC primer and compare it with the reported behavior of the listed issuers. Review the linked forum discussion for the DPoP and client_secret_basic context. Done means the specification clearly explains the applicable authentication options for /token requests.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.