Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Specify the client authentication method when using a Client Identifier #78

Open
NSeydoux opened this issue Nov 22, 2021 · 3 comments
Open

Specify the client authentication method when using a Client Identifier #78

NSeydoux opened this issue Nov 22, 2021 · 3 comments

Comments

@NSeydoux
Copy link
Contributor

When making a request to the token endpoint of an OIDC provider, a client usually authenticates itself. Client authentication methods at the token endpoint are described in the OpenID spec (and to some extent the OAuth 2.0 spec, and they usually rely on a client having a client id/secret pair, either through static or dynamic registration.

Solid-OIDC introduces a new type of client authentication based on a Client Identifier available at a URL under the client's control, which means that no client registration is required, and no client secret is involved. The only method described in the OpenID spec that aligns with the absence of a client secret and any other form of registration is the none client authentication method. In addition, the OAuth 2.0 spec seems to lean towards enforcing that HTTP Basic auth is only used when both a client id and secret are present. In the absence of a client secret, the client_id should therefore be sent as part of the token request body.

Considering all this, it may be good to add a note to the Solid-OIDC specification, in the Client Identifiers section along the following lines:

### Client Authentication to the token endpoint

Clients using a URI that can be dereferenced as a Client ID Document MUST authenticate to the Solid-OIDC provider's token endpoint by adding their `client_id` to the token request body, as described by the `none` client authentication method in [OIDC.Core].
@elf-pavlik
Copy link
Member

none
The Client does not authenticate itself at the Token Endpoint, either because it uses only the Implicit Flow (and so does not use the Token Endpoint) or because it is a Public Client with no Client Secret or other authentication mechanism.

This sounds reasonable to me, would you like to make PR with what you are proposing here?
We can also wait a little bit for feedback from @acoburn

Looking at https://openid.net/specs/openid-connect-core-1_0.html#TokenRequestValidation

Ensure the Authorization Code was issued to the authenticated Client.

OP needs to know client_id associated with the presented Authoization Code. Does the client really need to provide it in the Token Request?

@NSeydoux
Copy link
Contributor Author

I'll open a PR after having discussed this in today's panel meeting. And the way I understand the spec you linked to, if the client used some authentication method during the Authorization request, it should include its authentication information during the Token Request too.

@elf-pavlik elf-pavlik transferred this issue from solid/authentication-panel Feb 14, 2022
@elf-pavlik
Copy link
Member

I've been doing some research and it seems fine not to use client authentication with a token endpoint.

When it comes to refresh tokens there is some guidance in:

I'll add this issue inline to the spec to welcome more feedback. Based on that we should be able to close it eventually.

@elf-pavlik elf-pavlik mentioned this issue Mar 28, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@elf-pavlik @NSeydoux