Pass through nonce in code flow

[skion]

Nonces are optional in authorization_code flow, but still should be passed through if the RP provided one.

If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token

Also the claims parameter appeared to be processed twice.

[thedrow]

How come the tests did pass before that? This implies we're missing coverage for a code branch where nonces are not present.
Can you please add a unit test for this code branch?

[skion]

Reopening accidental close...

[wiliamsouza]

nonce is no longer required as stated by http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

nonce
OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. For implementation notes, see Section 15.5.2.

[skion]

@wiliamsouza It's always been optional in code flow, but should still be included if present.

[wiliamsouza]

With missing tests LGTM

[wiliamsouza]

Suggestion: Add the following text to method doc string:

+        nonce
+                OPTIONAL. String value used to associate a Client session with an
+                ID Token, and to mitigate replay attacks. The value is passed
+                through unmodified from the Authentication Request to the ID Token.
+                Sufficient entropy MUST be present in the nonce values used to
+                prevent attackers from guessing values

[skion]

Can you please add a unit test for this code branch?

@thedrow Something like this 13c6cf5?

Also, should the other OIDC params end up as credentials as well? If so, then can add them in similar way.

[thedrow]

@skion Can you please rebase this branch?
Also, what other OIDC parameters are we talking about?

[skion]

I think I did not spot max_age and acr_values anywhere, but we may also want things like claims_locales, request or request_uri eventually?

Rebased!

[thedrow]

Frankly I'm not familiar with OpenID as much as OAuth2 to tell you yes or no. Up to you.