Add implicit id_token flow #34
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some auth servers only allow the implicit flow for fetching an `id_token`. This flow is very straight forward, but it requires a few different steps than auth code. 1. The client requests a `response_type` `id_token`. 2. The request must contain `response_mode=form_post` otherwise the identity server will return parameters in the hash fragment. 3. The `id_token` can then be validated by the client.
|
Note, one incompatibility with the implicit flow and this library is the requirement of a |
|
Thank you for your PR. I'll review the PR at this weekend. |
|
@krdlab have you had a chance to look at this? |
krdlab
approved these changes
Dec 31, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are a few unrelated prefactor changes here, namely adding tooling configuration files.
Add implicit id_token flow
Some auth servers only allow the implicit flow for fetching an
id_token. This flow is very straight forward, but it requires a fewdifferent steps than auth code.
response_typeid_token.response_mode=form_postotherwise theidentity server will return parameters in the hash fragment.
id_tokencan then be validated by the client.MonadCatchandMonadThrowThis pull request does not utilize
MonadCatchorMonadThrow. My specific use case is utilizingyesod-auth, which requires authorization dispatch to exist within an abstract handler.That handler does not include
MonadCatchorMonadThrow. So the use of those constraints was prohibitive. Since all of the throwing and catching in this library happens withinIO, it is not necessary to useMonadCatchandMonadThrow. I have excluded them from this PR.