Support for OpenID with OAuth 2.1

[d-t-w]

Is there desire in the Jetty community for support for OpenID authentication with OAuth 2.1?

https://oauth.net/2.1/

While OAuth 2.1 is described as an 'in-process effort', in my experience it seems that many of the changes are being employed today, in particular my team have a specific interest in some of the changes due to client requests to support them in our products.

The main differences to OAuth 2.0 listed in the link above are:

• PKCE is required for all OAuth clients using the authorization code flow
• Redirect URIs must be compared using exact string matching
• The Implicit grant (response_type=token) is omitted from this specification
• The Resource Owner Password Credentials grant is omitted from this specification
• Bearer token usage omits the use of bearer tokens in the query string of URIs
• Refresh tokens for public clients must either be sender-constrained or rotated
• The definitions of public and confidential clients have been simplified to only refer to whether the client has credentials

In addition to these changes, there appear to be some other opportunities to extend Jetty's current implementation.

For example, OAuth 2.0 defines six authentication methods that the client can use with authenticating with the Token Endpoint.

Jetty currently supports:

• client_secret_post
• client_secret_basic

With OpendID + OAuth 2.1 there appears to be a recommendation to favour three of the currently un-implemented methods:

• private_key_jwt
• tls_client_auth
• self_signed_tls_client_auth

See: https://connect2id.com/learn/oauth-2-1#client-auth

I have a specific interest in:

• PKCE is required for all OAuth clients using the authorization code flow
• Supporting the three currently un-implemented methods of authentication to the Token Endpoint

If there's interest in extending Jetty's OpenID implementation I may be able to make time to contribute to my specific interests, but am unlikely to be able to manage the broader question of supporting a more holistic OAuth 2.1 implementation.

It may be that for Jetty, those specific needs are most of the work, I'm not entirely sure.

[lachlan-roberts]

Is there desire in the Jetty community for support for OpenID authentication with OAuth 2.1?

We haven't had any previous requests for OAuth 2.1 support, or requests for those additional Token Endpoint authentication methods.

However I think there would be value in extending the current OpenID Connect support in this direction if this is where OAuth 2.1 is heading.

If there's interest in extending Jetty's OpenID implementation I may be able to make time to contribute to my specific interests, but am unlikely to be able to manage the broader question of supporting a more holistic OAuth 2.1 implementation.

Jetty doesn't really have a broader OAuth implementation as such, we've only implemented the parts needed for the OpenID Connect authentication flow. So I don't think there is necessarily a larger OAuth 2.1 effort here, the relevant work for Jetty would mainly be adding PKCE support and the additional Token Endpoint authentication methods you mentioned.