Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] Add Implicit Grant Flow support #14

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

mvladev
Copy link
Contributor

@mvladev mvladev commented Oct 17, 2019

Add implicit flow support in the library for oauth2 and openid connect.

The way it works is the following:

  1. Start a local TLS server.
  2. Open a browser and navigate it to the local server.
  3. Wait for the user authorization.
  4. Receive a token via an authorization response (HTTP redirect).
  5. Post the URL fragment via JavaScript to a local endpoint.
  6. Return the token.

Point 5. is needed, because the browsers don't send the URL fragment, when they do a GET after a HTTP Redirect.

The new public functions introduced are in implicit.go.

Unfortunately to keep backwards compatibility I could not refactor some of the server fields in the Config struct, so I had to copy them to a dedicated struct.

An example of using the library has been added as well.

This is marked as WIP due to several reasons:

  • more tests are needed
  • token, id_token or token id_token have different requirements when doing the request and receiving the response (e.g. you have to use the scope openid when requesting id_token, redirect_uri is required for openid connect and more). Therefore would it make more sense to move those functions to separate packages and each having a dedicated struct?

More info
https://tools.ietf.org/html/rfc6749#section-4.2
https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth

implicit_test.go Outdated Show resolved Hide resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants