OpenID Connect Auth: Auto-populate values with well-known endpoint

[TCFox]

Is your feature request related to a problem? Please describe.
One thing that I find I spend a lot of time doing is adding fiddly authentication details to the Authentication tab, particularly when a request needs to auth using OAuth 2.0 flows. I often find myself manually copying these details out of the standardised document exposed at https://identityprovider.domain.tld/.well-known/openid-configuration.
Examples:

• Google
• Microsoft
• Apple

Technical Spec:

• OpenID Connect Discovery 1.0

Describe the solution you'd like
I would love to see either:

• A new "auth" option ("OpenID Connect"), or
• An enhancement to "OAuth 2.0" auth

...where the URL to https://identityprovider.domain.tld is supplied, which prompts Insomnia to query the /.well-known/openid-configuration document for details.

This gives us the following enhancements:

• "Authorisation URL" and "Token URL" are automatically discovered instead of having to be manually supplied.
• "Scope" under the "Advanced Options" can be enhanced with autocompletion or some other UI suggestion mechanism, since these can be discovered ahead of time (scopes_supported)
• "Credentials" under the "Advanced Options" can be automatically determined if only one of those two options are supported, and a UI warning displayed if an unsupported type is chosen (token_method_auth_endpoints_supported)
• "Grant Type" can be limited in a similar fashion (grant_types_supported)

Describe alternatives you've considered
While it's possible to enter all of these details manually into the "OAuth 2.0" auth fields, this would be a significant time saver, and may avoid accidental human error which may be difficult to debug.

Also, it may be useful to still enter incorrect details, for example while testing your auth flows for bugs or during security testing. I'll leave it to you to determine if it's better to:

• Hide fields entirely if they have exactly one supported value based on the openid-configuration document (easiest to use UI, least flexible)
• Have an "auto-populate"/"discover" button in the existing OAuth 2.0 tab (least intuitive, but most flexible)
• Suggest/Autocomplete OAuth 2.0 fields in the UI, but display warnings (⚠️) if these values do not appear to be valid based on the openid-configuration document

[gschier]

Thanks for the detailed request! This definitely seems like it has the ability to save a lot of time for OpenID users.

We currently don't have the bandwidth to work on this, but if you (or someone else) wants to make an attempt, we'd be happy to offer high-level guidance.

[imrishabh18]

@gschier Hey, can i take up this issue ?

[wdawson]

Hey @imrishabh18 sorry for the (very) long wait on a reply here. Feel free to take a stab at it if you'd like and we can iterate on it 👍

[TCFox]

@imrishabh18 I'm happy to provide assistance with high-level design decisions and technical details around how the spec works, but unfortunately my JavaScript skills won't be up to scratch to provide any help with the code itself, sorry!

[ryanholden8]

For what it's worth OpenAPI spec includes this type of security scheme.
Insomnia Swagger UI in design mode does not work though. See attached screenshots.

Blank popup:

This popup works fine in SwaggerUI editor tool and VS Code extension.