Update browser authorization to oidc-client-ts

[evelynpreslar-bentley]

No description provided.

[evelynpreslar-bentley]

oidc-client-ts is the currently active fork of oidc-client-js.

While the API is mostly identical, oidc-client-ts does make some breaking changes in its client constructor.
The client_id and authority parameters are now required, and necessary in order to process callbacks (previously, only a redirectURL was required, and the other properties were inferred).

This has the direct effect of requiring more upfront configuration in order to call BrowserAuthorizationCallbackHandler.handleCallback, but also has the indirect effect of disallowing callbacks to be processed with a single callback handler configuration.

Because oidc-client-ts no longer permits authority and clientId to be loaded from the state during a callback, a callback handler must be created for each authority/clientId combination. Otherwise, the state will not be loaded due to mismatching configuration.

This is of concern to any non-IMS services or extensions which utilize BrowserAuthorizationClient (like the SafetiBase frontstage in Design Review), since they are reliant on the parent app to handle callbacks for them.

[mattbjordan]

This PR still needs a codeowner review before it can be merged.

@aruniverse @ben-polinsky

[ben-polinsky]

@aruniverse trying to follow this. It's definitely a breaking change - do we need to test or update anything dependent on this package?

[aruniverse]

@aruniverse trying to follow this. It's definitely a breaking change - do we need to test or update anything dependent on this package?

yea im worried what the fallout of this will look like.

@mattbjordan can you pull this into a cospace with a viewer and see what happens?

[mattbjordan]

@mattbjordan can you pull this into a cospace with a viewer and see what happens?

Will do. Gotta figure out how to use cospace though as I haven't needed to before.

[mattbjordan]

@mattbjordan can you pull this into a cospace with a viewer and see what happens?

So, I got the cospace working and was able to run the viewer and connect to an iModel just fine. The only thing I had to change was having to use a BrowserAuthorizationCallbackHandlerConfiguration in the viewer.

Before

await BrowserAuthorizationCallbackHandler.handleSigninCallback(
  oidcConfiguration.redirectUri
);

After

await BrowserAuthorizationCallbackHandler.handleSigninCallback({
  redirectUri: oidcConfiguration.redirectUri,
  clientId: oidcConfiguration.clientId,
  authority: oidcConfiguration.authority // optional
});

Is there anything specific that you'd want me to test while I have this environment set up?

[aruniverse]

This is of concern to any non-IMS services or extensions which utilize BrowserAuthorizationClient (like the SafetiBase frontstage in Design Review), since they are reliant on the parent app to handle callbacks for them.

@jason-crow @jjbeckman13 fyi