feat: support client assertion for client credentials authentication#228
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #228 +/- ##
==========================================
- Coverage 88.18% 88.16% -0.02%
==========================================
Files 23 23
Lines 1202 1217 +15
Branches 211 197 -14
==========================================
+ Hits 1060 1073 +13
- Misses 84 86 +2
Partials 58 58 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
ewanharris
commented
May 30, 2025
ewanharris
commented
May 30, 2025
ewanharris
commented
May 30, 2025
rhamzeh
previously approved these changes
Jun 3, 2025
ewanharris
force-pushed
the
feat/support-client_assertion
branch
from
June 3, 2025 15:30
48b0e9f to
1cf2503
Compare
rhamzeh
approved these changes
Jun 3, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces support for performing a client credentials authentication flow using client assertion (aka private key jwt, jwt ca) as an alternative to the existing client secret authentication method.
As this is an alternative
ClientCredentialsmethod I have split the existing configuration out intoClientSecretConfigand introduced aPrivateKeyJWTto go along side this and changed theClientCredentialsConfigto be union of the two to allow type checking to work correctly.The client assertion signing is performed using jose and I am using v5 of this library over v6 as the latter is an ESM only package which would have implications for our supported Node.js versions.
An extra, not insignificant change to this is the addition of a
customClaimsproperty on the client credentials configuration, this is to allow extra data to be passed to the token exchange for clients that need this.References
Review Checklist
main