Means for authenticating on /token endpoint
Nobody has claimed this yet.
- Dominant language
- Bikeshed
- Stars
- 26
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
I was confused by 14. Token request with code and code verifier. So far none of the Solid pod issuers I've tried seem to require a DPoP header for a /token endpoint request.
So far, what's working for me is to use the client_secret_basic method in the request header, and not including a DPoP header. This is working for issuers:
Quite possibly this a function of issuers catching up with standards. But it took me quite a while to figure this out. And I'd rather others didn't have to go down this rabbit hole. Perhaps there could be some language about this?
See also https://forum.solidproject.org/t/the-use-of-dpop-in-the-token-endpoint/4664/6
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked “Token request with code and code verifier” section in the Solid OIDC primer and compare it with the reported behavior of the listed issuers. Review the linked forum discussion for the DPoP and client_secret_basic context. Done means the specification clearly explains the applicable authentication options for /token requests.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100