oauth2cli icon indicating copy to clipboard operation
oauth2cli copied to clipboard

[WIP] Add Implicit Grant Flow support

Open mvladev opened this issue 6 years ago • 0 comments

Add implicit flow support in the library for oauth2 and openid connect.

The way it works is the following:

  1. Start a local TLS server.
  2. Open a browser and navigate it to the local server.
  3. Wait for the user authorization.
  4. Receive a token via an authorization response (HTTP redirect).
  5. Post the URL fragment via JavaScript to a local endpoint.
  6. Return the token.

Point 5. is needed, because the browsers don't send the URL fragment, when they do a GET after a HTTP Redirect.

The new public functions introduced are in implicit.go.

Unfortunately to keep backwards compatibility I could not refactor some of the server fields in the Config struct, so I had to copy them to a dedicated struct.

An example of using the library has been added as well.

This is marked as WIP due to several reasons:

  • more tests are needed
  • token, id_token or token id_token have different requirements when doing the request and receiving the response (e.g. you have to use the scope openid when requesting id_token, redirect_uri is required for openid connect and more). Therefore would it make more sense to move those functions to separate packages and each having a dedicated struct?

More info https://tools.ietf.org/html/rfc6749#section-4.2 https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth

mvladev avatar Oct 17 '19 12:10 mvladev