add disablePkce config parameter

[Kwoin]

Address issue #1454

[damienbod]

Thanks for the PR.

I am not sure we should support this as using code flow without PKCE is not a good idea. A better solution would be to add support on the server or change the IDP.

Greetings Damien

[Kwoin]

Thanks for your review,

To better describe my case:

• IDP enforced by stakeholders
• client configured as "confidential" client in IDP
• IDP has no PKCE support for confidential client

I am aware that PKCE should be enabled for confidential as well as public client, but not all idp currently supports it for confidential client.

My current work around is to manually navigates to a hand-crafted URL :

          this.oidcSecurityService.checkAuth().subscribe(({isAuthenticated, userData, accessToken, idToken}) => {
            if (!isAuthenticated) {
              this.oidcSecurityService.getAuthorizeUrl().subscribe(url => {
                  const regex = /(.*?)\?(.*)/
                  const regexResult = regex.exec(url);
                  const params = regexResult[2]
                    .split("&")
                    .map(keyValueStr => keyValueStr.split("="))
                    .filter(keyValue => !["nonce", "code_challenge", "code_challenge_method"].includes(keyValue[0]))
                    .map(keyValue => keyValue.join("="))
                    .join("&");
                  const newUrl = `${regexResult[1]}?${params}`
                  navigateExternal(newUrl);
                }
              )
            }
          });

[Ducky2048]

I'm in the same boat: the IDP doesn't support PKCE and rejects the code exchange. I can't use a different IDP, and the IDP can't be made to support PKCE, for stupid large company reasons. It would be great if this PR could be merged. Maybe add stern warnings to the documentation, or even name the parameter "downgradeSecurityAndDisablePkce" or something like that so that no one will unneccessarily use it.

[FabianGosebrink]

Can you, @Kwoin , merge main back into your PR to get the builds green?

[damienbod]

Thanks @Kwoin

@FabianGosebrink I think we merge this once the PR is ready

• default must use PKCE
• We add this to the docs that it is not recommended

[Kwoin]

merge done.