issuer in discovery document contains trailing '/' #1482
Comments
|
Dupe of #1041 |
|
I see. The point is that the '/' addition cannot be undone. If I wanted a trailing slash I could have said so in the configuration. |
|
I don't understand the problem, to be honest. The issuer value is advertised in |
|
The client should verify the issuer. If you have existing clients, with some OP that does not state the trailings slash and migrate to Hydra, verification fails because of this. |
|
Again, the issuer url should be fetched from Additionally, this allows the OP to update the configuration (e.g. new issuer url) without having to update all of the clients by hand. If the clients consuming your OP are oidc conformant, they should verify the ID Token using that mechanism. That is the whole point of OIDC Dynamic Discovery. |
|
How would the client know about The error I was facing was this from line: |
|
Maybe superfluous, but from https://tools.ietf.org/html/draft-ietf-oauth-discovery-01#section-5 I conclude that the '/' is part of the .well-known part, not the issuer. |
It's a standard.
The CoreOS client apparently uses the parameter to initialize the client with that issuer value, and compares it with the value from
That conclusion is unfortunately wrong and also stems from OAuth 2.0 Discovery, which is unrelated to OpenID Connect. I'm closing this because we won't change the behavior in this system for the points made above. As stated in the other issue, not enforcing the trailing (or not) slash causes even more confusion with developers and punishes small mistakes (like forgetting the trailing slash in some config) severely with hour-long debugging sessions due to a small typo. |
|
fwiw coreos/go-oidc#203 |
|
The issuer URL used to retrieve the OpenID Configuration Discovery must be equal to the one returned by the discovery document. We could therefore add an option to append or strip trailing slashes in the configuration item. This is required because we would introduce a breaking change to existing deployments and must therefore keep existing behavior as is. |
|
No! |
|
anything new about this? |
|
I am marking this issue as stale as it has not received any engagement from the community or maintainers in over half a year. That does not imply that the issue has no merit! If you feel strongly about this issue
We are cleaning up issues every now and then, primarily to keep the 4000+ issues in our backlog in check and to prevent maintainer burnout. Burnout in open source maintainership is a widespread and serious issue. It can lead to severe personal and health issues as well as enabling catastrophic attack vectors. Thank you for your understanding and to anyone who participated in the issue! 🙏✌️ If you feel strongly about this issues and have ideas on resolving it, please comment. Otherwise it will be closed in 30 days! |
github-actions
bot
added
the
stale
|
Marked as stale in error. |
aeneasr
added
feat
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
|
Any chance that 1.11.x gets this fix? |
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.
Setting
```yaml
urls:
self:
issuer: https://auth.example.com
```
has changed
```patch
- "iss": "https://auth.example.com/"
+ "iss": "https://auth.example.com"
```
To set a trailing slash make sure to set it in the config value:
```yaml
urls:
self:
issuer: https://auth.example.com/
```
Closes #1482
Describe the bug
Setting
urls.self.issuerin the configuration without a trailing slash results in the issuer being advertised in the discovery document with a trailing slash. As clients need to validate this information it should be deterministic.Reproducing the bug
I expected
"https://auth.example.com"Server logs
Additional context
Other OP's:
Okta https://developer.okta.com/docs/reference/api/oidc/#response-example-success-6
Only auth0 seems to add a trailing slash as far as I can see.
When migrating to hydra I would like to avoid reconfiguring all clients.
The text was updated successfully, but these errors were encountered: