More OIDC configuration options

[gzxu]

Hi team,

We’re deploying Flipt within our team and integrating it with our company OIDC provider. We’ve run into two limitations:

• Token signing algorithm: Our OIDC provider only supports ES256 (unless an executive exception is approved). Flipt currently appears to hard-code RS256 here

  flipt/internal/server/authn/method/oidc/server.go

  Line 215 in 8ac6346

  []capoidc.Alg{oidc.RS256},

• Group claims truncation: Our OIDC provider omits group membership claims when a user belongs to more than three groups. In those cases, applications must call the OIDC /userinfo endpoint to retrieve the full group list (spec). Flipt currently does not call /userinfo.

We’ve implemented internal patches to address both issues and would like to contribute them upstream. Could you please review the following PRs?

• Support additional token signing algorithms: PR feat(oidc): support configurable token signing algorithms #5362, Issue feat(oidc): allow configuring accepted ID token signing algorithms #5361
• Optionally call the /userinfo endpoint: PR feat(oidc): optionally merge userinfo claims into auth session #5364, Issue feat(oidc): optionally fetch UserInfo claims during login #5363

Thank you for your time and consideration.

[gzxu]

Closing this discussion as both patches are merged