upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-18 18:38:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

oidc/provider: adds code_challenge_methods_supported to metadata (#24979)

Browse source 
* oidc/provider: adds code_challenge_methods_supported to metadata

* adds changelog

* adds docs
This commit is contained in:
Austin Gebauer 2024-01-22 13:40:13 -08:00 committed by GitHub
parent 4811fd1962
commit 677d98a821
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog/24979.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:improvement
oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata
```

5
vault/identity_store_oidc_provider.go
View file

@ -166,6 +166,7 @@ type providerDiscovery struct {
Subjects []string `json:"subject_types_supported"`
GrantTypes []string `json:"grant_types_supported"`
AuthMethods []string `json:"token_endpoint_auth_methods_supported"`
CodeChallengeMethods []string `json:"code_challenge_methods_supported"`
}
type authCodeCacheEntry struct {
@ -1572,6 +1573,10 @@ func (i *IdentityStore) pathOIDCProviderDiscovery(ctx context.Context, req *logi
"client_secret_basic",
"client_secret_post",
},
CodeChallengeMethods: []string{
codeChallengeMethodPlain,
codeChallengeMethodS256,
},
}
data, err := json.Marshal(disc)

2
vault/identity_store_oidc_provider_test.go
View file

@ -3637,6 +3637,7 @@ func TestOIDC_Path_OpenIDProviderConfig(t *testing.T) {
AuthMethods: []string{"none", "client_secret_basic", "client_secret_post"},
RequestParameter: false,
RequestURIParameter: false,
CodeChallengeMethods: []string{codeChallengeMethodPlain, codeChallengeMethodS256},
}
discoveryResp := &providerDiscovery{}
json.Unmarshal(resp.Data["http_raw_body"].([]byte), discoveryResp)
@ -3693,6 +3694,7 @@ func TestOIDC_Path_OpenIDProviderConfig(t *testing.T) {
AuthMethods: []string{"none", "client_secret_basic", "client_secret_post"},
RequestParameter: false,
RequestURIParameter: false,
CodeChallengeMethods: []string{codeChallengeMethodPlain, codeChallengeMethodS256},
}
discoveryResp = &providerDiscovery{}
json.Unmarshal(resp.Data["http_raw_body"].([]byte), discoveryResp)

7
website/content/api-docs/secret/identity/oidc-provider.mdx
View file

@ -605,7 +605,12 @@ $ curl \
"client_secret_basic",
"client_secret_post",
"none"
]}
],
"code_challenge_methods_supported": [
"plain",
"S256"
]
}
```
## Read provider public keys

4
website/content/docs/secrets/identity/oidc-provider.mdx
View file

@ -127,6 +127,10 @@ Any Vault auth method may be used within the OIDC flow. For simplicity, enable t
"none",
"client_secret_basic",
"client_secret_post"
],
"code_challenge_methods_supported": [
"plain",
"S256"
]
}
```