Do not try to verify id_token when id_token is not used

[m0n9oose]

fix #40

[Sutto]

+1 to this - We hit this trying to integrate a Keycloak SSO client with our app, as the default flow won't return an id_token, so without this it crashes with an internal exception.

[m0n9oose]

@Sutto have you tried to use branch with fix?

gem 'omniauth_openid_connect', git: 'https://github.com/m0n9oose/omniauth_openid_connect.git', branch: 'fix_redundant_token_verification'

[Sutto]

Yehp! The fix works perfectly in our case, thank you - It'd be nice to see this in a released gem version, so we don't have to depend on a git repo.

Thanks for building this btw!

[swapab]

@m0n9oose Thanks for maintaining omniauth_openid_connect gem.

The proposed change complies to openid-specs and should be merged. But, there is slight caveat which probably needs to be addressed as well.
The call valid_response_type? should be removed. According to the openid-documentation and examples response_type is not returned in the Location header of the response.

Rather the validation should be in request_phase instead ofcallback_phase.
The RFC also says the same: https://tools.ietf.org/html/rfc6749

---

Let me know what you think about it and I can create a new pull request.

[m0n9oose]

@m0n9oose Thanks for maintaining omniauth_openid_connect gem.

The proposed change complies to openid-specs and should be merged. But, there is slight caveat which probably needs to be addressed as well.
The call valid_response_type? should be removed. According to the openid-documentation and examples response_type is not returned in the Location header of the response.

Rather the validation should be in request_phase instead ofcallback_phase.
The RFC also says the same: https://tools.ietf.org/html/rfc6749

Let me know what you think about it and I can create a new pull request.

@swapab thanks for your feedback and efforts to gather all this information, this is an excellent example of productive discussion!

I would be very appreciated if you can fork this repo and open a new pull request with additional improvements.

[m0n9oose]

@swapab any luck with implementation according to the RFC?