Claims support (#54)

Author: ikawalec

cmd/oauth2.go

@@ -72,6 +72,7 @@ func NewOAuth2Cmd() (cmd *OAuth2Cmd) {
 	cmd.PersistentFlags().BoolVar(&cconfig.Insecure, "insecure", false, "allow insecure connections")
 	cmd.PersistentFlags().BoolVarP(&silent, "silent", "s", false, "silent mode")
 	cmd.PersistentFlags().BoolVar(&cconfig.DPoP, "dpop", false, "use DPoP")
+	cmd.PersistentFlags().StringVar(&cconfig.Claims, "claims", "", "claims parameter")
 
 	return cmd
 }

docs/examples.md

@@ -23,7 +23,8 @@ oauth2c https://oauth2c.us.authz.cloudentity.io/oauth2c/demo \
   --response-mode query \
   --grant-type authorization_code \
   --auth-method client_secret_basic \
-  --scopes openid,email,offline_access
+  --scopes openid,offline_access \
+  --claims '{"id_token":{"email": {"essential": true}}}'
 ```
 </details>
 

internal/oauth2/oauth2.go

@@ -85,6 +85,7 @@ type ClientConfig struct {
 	TLSKey                 string
 	TLSRootCA              string
 	DPoP                   bool
+	Claims                 string
 }
 
 func RequestAuthorization(cconfig ClientConfig, sconfig ServerConfig, hc *http.Client) (r Request, codeVerifier string, err error) {

internal/oauth2/request.go

@@ -76,6 +76,10 @@ func (r *Request) AuthorizeRequest(
 		r.Form.Set("code_challenge_method", "S256")
 	}
 
+	if cconfig.Claims != "" {
+		r.Form.Set("claims", cconfig.Claims)
+	}
+
 	if cconfig.RequestObject || cconfig.EncryptedRequestObject {
 		claims := RequestObjectClaims(r.Form, sconfig, cconfig)