Giters

openiddict / openiddict-samples

.NET samples for OpenIddict

Home Page:https://documentation.openiddict.com/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Any samples for grant type client credentials and client assertions?

svasui123 opened this issue · comments

commented

Confirm you've already contributed to this project or that you sponsor it

  • I confirm I'm a sponsor or a contributor

Version

3.x

Question

We are testing a Smart FHIR implementation with openiddict. I am stuck on the client assertion flow and would request any links to documentation or samples that implement or can help implement client assertion and client credentials.

commented

private_key_jwt is already supported by the new OpenIddict client as it was required for the Apple SignIn provider but the OpenIddict server doesn't support it yet. Native support for client assertions is tracked by openiddict/openiddict-core#1251.

If it's important for your company, let me know, it's something we can likely fund and implement for 4.0.

commented

It would definitely be of great value to anyone who is using Openiddict to comply with FHIR and OAUTH2 requirements. Assertion grant flows are 1 of the 4 vignettes that are tested. I will look at the samples and define a custom flow that handles assertion grants (I saw your comment about this flow technically being similar to the password flow). We are currently going through the certification process and this is the last hurdle.

Yes adding it to 4.0 would help.

commented

Assertion grant flows are 1 of the 4 vignettes that are tested. I will look at the samples and define a custom flow that handles assertion grants (I saw your comment about this flow technically being similar to the password flow).

It's worth noting that client assertions != assertion grants: the former are generated to serve as client credentials while the second are generated to serve as an entity identity (typically a user).

commented
commented

If you can't/don't want to wait for built-in support, you'll need to replace these 2 handlers:

It's not mandatory but you'll probably want to tweak the configuration document to indicate your server instance supports client assertions. For that, you'll need to add private_key_jwt (assuming you're using asymmetric signing keys) to HandleConfigurationRequestContext.TokenEndpointAuthenticationMethods.

See https://github.com/openiddict/openiddict-core/blob/eb8715d96440c05400b3613d37ca64385d79c042/src/OpenIddict.Server/OpenIddictServerHandlers.Discovery.cs#L491-L535 for the handler responsible for adding client_secret_basic/client_secret_post.

commented
commented

I followed the instructions given in openiddict/openiddict-core#736 to wire up an event handler. When I try to add options.AddEventHandler<HandleConfigurationRequestContext, MyEventHandler> (); under AddServer it is giving me an error. What is the new syntax?

commented

Having said that I think working with these handlers would help me better understand this extremely well done package.

Haha, thanks for the kind words! 😃

What is the new syntax?

I'd recommend using the same approach as the one used for the built-in handlers:

public class YourCustomHandler : IOpenIddictServerHandler<...>
{
    /// <summary>
    /// Gets the default descriptor definition assigned to this handler.
    /// </summary>
    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
        = OpenIddictServerHandlerDescriptor.CreateBuilder<...>()
            .UseSingletonHandler<YourCustomHandler>()
            .SetOrder(...)
            .SetType(OpenIddictServerHandlerType.Custom)
            .Build();

    /// <inheritdoc/>
    public ValueTask HandleAsync(... context)
    {
        ...
    }
}
options.AddEventHandler(YourCustomHandler.Descriptor);

Alternatively, you can also use inline handlers, as shown in https://documentation.openiddict.com/guides/index.html#events-model.

commented
commented

I suspect this could be related to the fact you're trying to subclass the built-in ValidateClientSecret handler, which is something you should never do.

Instead, create your own independent handler - that don't subclass ValidateClientSecret - and remove the built-in one by doing options.RemoveEventHandler(ValidateClientSecret.Descriptor).

commented
commented
commented

Hey Vasu,

Support for client authentication assertions in the server stack is tracked by openiddict/openiddict-core#1251. 4.0 (whose 3rd preview shipped yesterday) will mostly focus on the whole new client stack so it's likely something that will need to wait a bit (maybe 5.0 or 6.0?).

Cheers.

commented