How do we set the redirect_uri

[anshudutta]

I have a kubernetes CRD like so

apiVersion: v1
data:
  client_id: Z3JhZmFuYS1vYXV0aDItZXhwZXJpbWVudA==
  client_secret: MTIzNDU2LWV4cGVyaW1lbnQ=
kind: Secret
metadata:
  name: grafana-oauth2-secret
  namespace: hydra
type: Opaque

---
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
  name: grafana-oauth2-client
  namespace: hydra
spec:
  grantTypes:
    - client_credentials
    - implicit
    - authorization_code
    - refresh_token
  responseTypes:
    - id_token
    - code
    - token
  scope: "grafana"
  secretName: grafana-oauth2-secret

When I query a GET request to the admin server - http://hydra-admin:4445/client, I see two issues

1. The redirect_uris is null
2. The client_id, that was passed is set as client_name

{
    "client_id": "e2bd5fa5-9f6d-4773-9334-25310e522a23",
    "client_name": "grafana-oauth2-client",
    "redirect_uris": null,
    "grant_types": [
      "client_credentials",
      "implicit",
      "authorization_code",
      "refresh_token"
    ],
    "response_types": [
      "id_token",
      "code",
      "token"
    ],
    "scope": "grafana",
    "audience": null,
    "owner": "",
    "policy_uri": "",
    "allowed_cors_origins": null,
    "tos_uri": "",
    "client_uri": "",
    "logo_uri": "",
    "contacts": null,
    "client_secret_expires_at": 0,
    "subject_type": "public",
    "token_endpoint_auth_method": "client_secret_basic",
    "userinfo_signed_response_alg": "none",
    "created_at": "2019-10-16T23:12:34Z",
    "updated_at": "2019-10-16T23:12:34Z"
  }

This doesn't work because without setting the redirect_uris, hydra fails validation for oauth-client request

The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed" error=invalid_request hint="The \"redirect_uri\" parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls

But I could not find any way to set it.
I think the problem is that the current code is designed for grant type client_credentials even though it says that it is designed for all grant types. Because only that grant type doesn't need a redirect_uri

[paulbdavis]

I am having the same issue. By setting a value in the database manually, it makes it work (so far, still working on implementing the whole flow) even without specifying it in the url

[aeneasr]

/cc @jakkab

[piotrmsc]

According to https://github.com/ory/hydra-maester/blob/master/api/v1alpha1/oauth2client_types.go#L35 it's not possible to set redirect_uri and current CRD is designed like you mentioned, for client_credentials only. Other properties of oauth2 client are not presenet as well.
Which obviously is a bug :(

/cc @jakkab @aeneasr

[jakkab]

@anshudutta
ad1. As mentioned above, we need to adjust the CRD, PR is coming.
ad2. I've created the resources you provided (secret + oauth2client) on a cluster and everything seems to work just fine. In your case, the registered client should have the following properties:
"client_id":"grafana-oauth2-experiment" (from secret)
"client_name":"" (this field is not populated)
"owner": "grafana-oauth2-client/hydra" (name/namespace of the kubernetes resource that represents this client)
Please make sure you're using the latest release.

[paulbdavis]

I have opened #30 to fix this particular part.

@jakkab @aeneasr I think that the CRD should be filled out and finalized as much as it can as soon as possible, since the CRD is a global resource and there may be many instances of the maester running in different namespaces

[p-bakker]

As this case is about redirect_urls, which have been implemented by #30 already, should this case be closed and a new one opened to augment the CRD with all the stuff that is missing (see https://www.ory.sh/docs/hydra/sdk/api#schemaoauth2client for everything that can be set on a client)?

@jakkab You said:

ad1. As mentioned above, we need to adjust the CRD, PR is coming.

Is this a PR to augment the CRD with everything a oauth client in Hydra can have, or were you just talking about adding the redirect_urls?

[piotrmsc]

Hi @p-bakker , for other properties please create separate issue ;-) PR provided by @paulbdavis added redirect_uris only to crd spec.

[p-bakker]

Created #36

So I think this case can be closed now