mirror of
https://github.com/zitadel/zitadel.git
synced 2025-03-01 08:37:28 +00:00
8f88c4cf5b
# Which Problems Are Solved Some OAuth2 and OIDC providers require the use of PKCE for all their clients. While ZITADEL already recommended the same for its clients, it did not yet support the option on the IdP configuration. # How the Problems Are Solved - A new boolean `use_pkce` is added to the add/update generic OAuth/OIDC endpoints. - A new checkbox is added to the generic OAuth and OIDC provider templates. - The `rp.WithPKCE` option is added to the provider if the use of PKCE has been set. - The `rp.WithCodeChallenge` and `rp.WithCodeVerifier` options are added to the OIDC/Auth BeginAuth and CodeExchange function. - Store verifier or any other persistent argument in the intent or auth request. - Create corresponding session object before creating the intent, to be able to store the information. - (refactored session structs to use a constructor for unified creation and better overview of actual usage) Here's a screenshot showing the URI including the PKCE params:  # Additional Changes None. # Additional Context - Closes #6449 - This PR replaces the existing PR (#8228) of @doncicuto. The base he did was cherry picked. Thank you very much for that! --------- Co-authored-by: Miguel Cabrerizo <doncicuto@gmail.com> Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
30 lines
1.1 KiB
Go
30 lines
1.1 KiB
Go
package idp
|
|
|
|
import (
|
|
"context"
|
|
)
|
|
|
|
// Session is the minimal implementation for a session of a 3rd party authentication [Provider]
|
|
type Session interface {
|
|
GetAuth(ctx context.Context) (content string, redirect bool)
|
|
PersistentParameters() map[string]any
|
|
FetchUser(ctx context.Context) (User, error)
|
|
}
|
|
|
|
// SessionSupportsMigration is an optional extension to the Session interface.
|
|
// It can be implemented to support migrating users, were the initial external id has changed because of a migration of the Provider type.
|
|
// E.g. when a user was linked on a generic OIDC provider and this provider has now been migrated to an AzureAD provider.
|
|
// In this case OIDC used the `sub` claim and Azure now uses the id of the user endpoint, which differ.
|
|
// The RetrievePreviousID will return the `sub` claim again, so that the user can be matched and safely migrated to the new id.
|
|
type SessionSupportsMigration interface {
|
|
RetrievePreviousID() (previousID string, err error)
|
|
}
|
|
|
|
func Redirect(redirectURL string) (string, bool) {
|
|
return redirectURL, true
|
|
}
|
|
|
|
func Form(html string) (string, bool) {
|
|
return html, false
|
|
}
|