oauth2: Reintroduce audience claim #687

Activity

1. aeneasr

   added this to the unplanned milestone on Jan 15, 2018
2. aeneasr

   modified the milestones: unplanned, 1.0.0This milestone has been deleted on Feb 9, 2018
3. someone1 commented on Feb 28, 2018

   

   someone1

   on Feb 28, 2018

   Contributor

   More actions

   The session seems to persist the request.Form so maybe this can already be done with slight modification of the challenge session persistence?

   If a request comes to the /oauth2/auth handler with an audience URL parameter (in addition to the client_id, state, redirect_uri, etc. like Auth0 does), then this can be persisted in the ConsentRequest and returned as part of the Session.

   Side note, it looks like hydra is treating every auth request as an OpenID Connect request? Unless scope=openid is specified, you do not need to force the aud=client_id behavior. All Sessions seem to be represented internally as fosite openid.DefaultSessions. I don't think this impacts anything but was confusing to me as I was trying to use hydra's handlers and wanted to use JWT tokens but got an OpenID token instead.
4. someone1 commented on Feb 28, 2018

   

   someone1

   on Feb 28, 2018

   Contributor

   More actions

   Depending on how issue #772 is implemented, this might be rolled up into those changes?
5. aeneasr commented on Mar 3, 2018

   

   aeneasr

   on Mar 3, 2018

   MemberAuthor

   More actions

   The session seems to persist the request.Form so maybe this can already be done with slight modification of the challenge session persistence?

   Yes, that's the case indeed

   If a request comes to the /oauth2/auth handler with an audience URL parameter (in addition to the client_id, state, redirect_uri, etc. like Auth0 does), then this can be persisted in the ConsentRequest and returned as part of the Session.

   I'm not quite sure at the moment - is this specified in some spec somewhere? Auth0 is known to bake in some weird custom stuff in their system which is also why they had to basically deprecate all the old APIs.

   Side note, it looks like hydra is treating every auth request as an OpenID Connect request? Unless scope=openid is specified, you do not need to force the aud=client_id behavior. All Sessions seem to be represented internally as fosite openid.DefaultSessions. I don't think this impacts anything but was confusing to me as I was trying to use hydra's handlers and wanted to use JWT tokens but got an OpenID token instead.

   Kinda, we have handlers which "hook" in functionality based on request parameters. If openid is specified as a scope, an OpenID Connect handler will try to process the request.

   Depending on how issue #772 is implemented, this might be rolled up into those changes?

   Absolutely
6. aeneasr

   modified the milestones: 1.0.0This milestone has been deleted, 1.0.0-alpha.1 on Apr 19, 2018
7. aeneasr

   modified the milestones: 1.0.0-alpha.1, 1.0.0This milestone has been deleted on May 25, 2018
8. aeneasr

   added

   featNew feature or request.New feature or request.

   package/oauth2

   package/consent

   on May 25, 2018
9. aeneasr

   self-assigned this

   on May 25, 2018
10. aeneasr

    added a commit that references this issue on May 29, 2018

    oauth2: Resolves various issues related to audience claims

    ...

    This issue will close once commit e08f82c is merged into the 'master' branch.

    e08f82c
11. aeneasr

    closed this as completedin 7afed88on May 29, 2018