azp claim not present in JWT token - is there a way to turn validation off?

[matf3en]

I'm trying to auth with Oracle's 'Netsuite' ERP using OAuth2 and Open ID Connect via Next-Auth.

Broadly, everything is going okay, but it turns out that the JWT returned by Netsuite does not include the azp claim.

So the Next-Auth flow fails with an error :

`[next-auth][error][OAUTH_CALLBACK_ERROR]
https://next-auth.js.org/errors#oauth_callback_error missing required JWT property azp {
error: RPError: missing required JWT property azp
......

name: 'OAuthCallbackError',
code: undefined

},
providerId: 'netsuite',
message: 'missing required JWT property azp'`

There is no ability to add the azp (this decade) from Netsuite side.

So, is there a way to stop the Next-Auth validation from checking the azp claim or to make the azp claim not required?

Thanks

[mbaquerizo]

@matf3en wondering if you ever figured this out? Running into the same issue now.

[mbaquerizo]

Seems like Netsuite sends multiple values which is why the azp check is triggered.

See https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_161235023782.html#subsect_161235051736

The value of the aud parameter is the Application ID of the integration record, and the company, separated by a semicolon. Additionally, the client ID is a part of the aud parameter, separated by a comma. For example, 1A111AA1–AA11–1A11–1111–A1A1111111A1;1111, 661131f7bf0a2f8a4d09c79d3fa961eab66102dca43e07ad47d3a29628ced67b.
-- | --

[jdpnielsen]

This might help - i solved this issue by patching nextjs to forward clientOptions to openid-client:

diff --git a/node_modules/next-auth/core/lib/oauth/client.js b/node_modules/next-auth/core/lib/oauth/client.js
index c2f0d40..9074cdf 100644
--- a/node_modules/next-auth/core/lib/oauth/client.js
+++ b/node_modules/next-auth/core/lib/oauth/client.js
@@ -31,7 +31,7 @@ async function openidClient(options) {
     client_secret: provider.clientSecret,
     redirect_uris: [provider.callbackUrl],
     ...provider.client
-  }, provider.jwks);
+  }, provider.jwks, provider.clientOptions);
   client[_openidClient.custom.clock_tolerance] = 10;
   return client;
 }
\ No newline at end of file
diff --git a/node_modules/next-auth/providers/oauth.d.ts b/node_modules/next-auth/providers/oauth.d.ts
index c2adf84..12fd796 100644
--- a/node_modules/next-auth/providers/oauth.d.ts
+++ b/node_modules/next-auth/providers/oauth.d.ts
@@ -86,6 +86,10 @@ export interface OAuthConfig<P> extends CommonProviderOptions, PartialIssuer {
     profile: (profile: P, tokens: TokenSet) => Awaitable<User>;
     checks?: ChecksType | ChecksType[];
     client?: Partial<ClientMetadata>;
+    /**
+     * Allows configuration of additional open-id client options
+     */
+    clientOptions?: Partial<ClientMetadata>;
     jwks?: {
         keys: JWK[];
     };
diff --git a/node_modules/next-auth/src/providers/oauth.ts b/node_modules/next-auth/src/providers/oauth.ts
index e19d654..0980a23 100644
--- a/node_modules/next-auth/src/providers/oauth.ts
+++ b/node_modules/next-auth/src/providers/oauth.ts
@@ -123,6 +123,10 @@ export interface OAuthConfig<P> extends CommonProviderOptions, PartialIssuer {
   profile: (profile: P, tokens: TokenSet) => Awaitable<User>
   checks?: ChecksType | ChecksType[]
   client?: Partial<ClientMetadata>
+  /**
+   * Allows configuration of additional open-id client options
+   */
+  clientOptions?: Partial<ClientMetadata>;
   jwks?: { keys: JWK[] }
   clientId?: string
   clientSecret?: string

Then just configure the value in provider:

clientOptions: {
	additionalAuthorizedParties: ['audience'],
},

[mbaquerizo]

Thanks @jdpnielsen , I opened up a PR a few days ago to get this added: #10949 based on your patch and the discussions I found on here.

Not sure if it'll be merged in, but I'd appreciate a review in case I missed something/in case it helps get more eyes on it