[Feature Request] OpenID Connect Authentication

[heuristicAL]

• Insomnia Version: 5.8.4 (5.8.4.1085)
• Operating System: MacOS High Sierra - 10.13 (17A365)

Details

Add the "id_token" ResponseType to Implicit flow so that the response type can either be automatically or manually set to "ResponseType: "id_token token".

Alternately, please add the OIDC Authentication type, which should include the "id_token token" Response type when using OIDC Implicit flow.

I'm unsure if adding the id_token response type to OAuth2 authentication will break anything but this is required for OIDC Implicit flow and thus does not allow us to test our authentication. Adding this would be GREAT, especially since it is VERY similar to OAth2

[gschier]

Hi @heuristicAL, thanks for the request!

I'm unfamiliar with OpenID authentication. Can you explain exactly how a traditional OAuth 2.0 flow would need to be modified to support it? I see that it mentions JWTs but I'm unsure in which step they are used.

I'd be happy to provide guidance if you want to put together a PR to add this functionality.

[heuristicAL]

Hi @gschier ,

I can't say I'm a complete expert at this but I'm totally willing to give it a try. I think that at it's base, OIDC just requires that the id_token response type be present when making the request otherwise it does not respond with the token. Like I mentioned: I'm not sure if the presence of id_token as well as token in OAuth2 would cause problems as I havent had time to look into that but I know that both are accepted in OIDC and id_token is required.

If you could point me to the general area that I should check to add OIDC as an option, I'll have a look as soon as I have some free time!

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[rodrigogs]

I'm having the same problem. When you authenticate the backend using Google OAuth2, you need to give it the id_token field which is returned in reponse.body.id_token.

It would be nice to have a way of selecting the OAuth2 response property. Something like:
{% request 'oauth2', 'response.body.id_token' %}