Merge pull request #184 from m0rt3nlund/client_authentication_method

Allow "none" method

Author: danschultzer

CHANGELOG.md

@@ -13,6 +13,7 @@ Now requires Elixir 1.15 / OTP 26.
 * `:inets` is now started automatically by `Assent`, and no longer required in `:extra_applications`
 * `Assent.JWTAdapter.AssentJWT` now supports EdDSA algorithms
 * `Assent.JWTAdapter.AssentJWT` now supports EC JWKs
+* `Assent.Strategy.OIDC` no longer rejects a `:client_authentication_method` missing from the provider's `token_endpoint_auth_methods_supported`
 
 ### Bug fixes
 

lib/assent/strategies/oidc.ex

@@ -282,7 +282,7 @@ defmodule Assent.Strategy.OIDC do
   @spec callback(Keyword.t(), map(), atom()) :: on_callback()
   def callback(config, params, strategy \\ __MODULE__) do
     with {:ok, openid_config} <- fetch_openid_configuration(config),
-         {:ok, method} <- fetch_client_authentication_method(openid_config, config),
+         {:ok, method} <- fetch_client_authentication_method(config),
          {:ok, token_url} <- fetch_from_openid_config(openid_config, "token_endpoint") do
       config
       |> Keyword.put(:openid_configuration, openid_config)
@@ -292,15 +292,10 @@ defmodule Assent.Strategy.OIDC do
     end
   end
 
-  defp fetch_client_authentication_method(openid_config, config) do
-    method = Keyword.get(config, :client_authentication_method, "client_secret_basic")
-    methods = Map.get(openid_config, "token_endpoint_auth_methods_supported")
-    supported_method? = (is_nil(methods) && true) || method in methods
-
-    case supported_method? do
-      true -> parse_client_auth_method(method)
-      false -> {:error, "Unsupported client authentication method: #{method}"}
-    end
+  defp fetch_client_authentication_method(config) do
+    config
+    |> Keyword.get(:client_authentication_method, "client_secret_basic")
+    |> parse_client_auth_method()
   end
 
   defp parse_client_auth_method("none"), do: {:ok, nil}

test/assent/strategies/auth0_test.exs

@@ -36,11 +36,7 @@ defmodule Assent.Strategy.Auth0Test do
   end
 
   test "callback/2", %{config: config, callback_params: params} do
-    openid_config =
-      config[:openid_configuration]
-      |> Map.put("issuer", "https://{yourDomain}/")
-      |> Map.put("token_endpoint_auth_methods_supported", ["client_secret_post"])
-
+    openid_config = Map.put(config[:openid_configuration], "issuer", "https://{yourDomain}/")
     session_params = Map.put(config[:session_params], :nonce, "crypto-value")
 
     config =

test/assent/strategies/azure_ad_test.exs

@@ -40,12 +40,11 @@ defmodule Assent.Strategy.AzureADTest do
 
   test "callback/2", %{config: config, callback_params: params} do
     openid_config =
-      config[:openid_configuration]
-      |> Map.put(
+      Map.put(
+        config[:openid_configuration],
         "issuer",
         "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0"
       )
-      |> Map.put("token_endpoint_auth_methods_supported", ["client_secret_post"])
 
     session_params = Map.put(config[:session_params], :nonce, "123523")
 

test/assent/strategies/gitlab_test.exs

@@ -43,15 +43,11 @@ defmodule Assent.Strategy.GitlabTest do
   end
 
   test "callback/2", %{config: config, callback_params: params} do
-    openid_config =
-      Map.put(config[:openid_configuration], "token_endpoint_auth_methods_supported", [
-        "client_secret_post"
-      ])
-
     config =
-      Keyword.merge(config,
-        openid_configuration: openid_config,
-        client_id: "4843ae8973e91d7f63baf626a88e221648d8839d0edee5878c9f1535f6930a1a"
+      Keyword.put(
+        config,
+        :client_id,
+        "4843ae8973e91d7f63baf626a88e221648d8839d0edee5878c9f1535f6930a1a"
       )
 
     [key | _rest] = expect_oidc_jwks_uri_request()

test/assent/strategies/google_test.exs

@@ -35,9 +35,7 @@ defmodule Assent.Strategy.GoogleTest do
 
   test "callback/2", %{config: config, callback_params: params} do
     openid_config =
-      config[:openid_configuration]
-      |> Map.put("issuer", "https://accounts.google.com")
-      |> Map.put("token_endpoint_auth_methods_supported", ["client_secret_post"])
+      Map.put(config[:openid_configuration], "issuer", "https://accounts.google.com")
 
     session_params = Map.put(config[:session_params], :nonce, "0394852-3190485-2490358")
 

test/assent/strategies/oidc_test.exs

@@ -45,21 +45,6 @@ defmodule Assent.Strategy.OIDCTest do
                {:error, "Invalid client authentication method: invalid"}
     end
 
-    test "with unsupported authentication method", %{config: config, callback_params: params} do
-      openid_configuration =
-        Map.put(config[:openid_configuration], "token_endpoint_auth_methods_supported", [
-          "private_key_jwt"
-        ])
-
-      config =
-        config
-        |> Keyword.put(:client_authentication_method, "client_secret_basic")
-        |> Keyword.put(:openid_configuration, openid_configuration)
-
-      assert OIDC.callback(config, params) ==
-               {:error, "Unsupported client authentication method: client_secret_basic"}
-    end
-
     test "with missing `token_endpoint` configuration options", %{
       config: config,
       callback_params: params
@@ -187,15 +172,9 @@ defmodule Assent.Strategy.OIDCTest do
       config: config,
       callback_params: params
     } do
-      openid_configuration =
-        Map.put(config[:openid_configuration], "token_endpoint_auth_methods_supported", [
-          "private_key_jwt"
-        ])
-
       config =
         config
         |> Keyword.put(:client_authentication_method, "private_key_jwt")
-        |> Keyword.put(:openid_configuration, openid_configuration)
         |> Keyword.put(:private_key, @private_rsa_key)
         |> Keyword.put(:private_key_id, "key_id")