Skip to content

Make token_endpoint_auth_signing_alg_values_supported optional in upstream OIDC providers metadata #4984

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 12, 2025
+14 −61
Merged

Make token_endpoint_auth_signing_alg_values_supported optional in upstream OIDC providers metadata #4984

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 14 additions & 61 deletions crates/oauth2-types/src/oidc.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -692,10 +692,6 @@ impl ProviderMetadata {
.token_endpoint_auth_signing_alg_values_supported
.iter()
.flatten(),
metadata
.token_endpoint_auth_methods_supported
.iter()
.flatten(),
)?;

if let Some(url) = &metadata.revocation_endpoint {
Expand All @@ -708,33 +704,18 @@ impl ProviderMetadata {
.revocation_endpoint_auth_signing_alg_values_supported
.iter()
.flatten(),
metadata
.revocation_endpoint_auth_methods_supported
.iter()
.flatten(),
)?;

if let Some(url) = &metadata.introspection_endpoint {
validate_url("introspection_endpoint", url, ExtraUrlRestrictions::None)?;
}

// The list can also contain token types so remove them as we don't need to
// check them.
let introspection_methods = metadata
.introspection_endpoint_auth_methods_supported
.as_ref()
.map(|v| {
v.iter()
.filter_map(AuthenticationMethodOrAccessTokenType::authentication_method)
.collect::<Vec<_>>()
});
validate_signing_alg_values_supported(
"introspection_endpoint",
metadata
.introspection_endpoint_auth_signing_alg_values_supported
.iter()
.flatten(),
introspection_methods.into_iter().flatten(),
)?;

if let Some(url) = &metadata.userinfo_endpoint {
Expand Down Expand Up @@ -1099,12 +1080,6 @@ pub enum ProviderMetadataVerificationError {
#[error("missing `implicit` grant type")]
GrantTypesMissingImplicit,

/// The given endpoint is missing auth signing algorithm values, but they
/// are required because it supports at least one of the `client_secret_jwt`
/// or `private_key_jwt` authentication methods.
#[error("{0} missing auth signing algorithm values")]
MissingAuthSigningAlgValues(&'static str),

/// `none` is in the given endpoint's signing algorithm values, but is not
/// allowed.
#[error("{0} signing algorithm values contain `none`")]
Expand Down Expand Up @@ -1176,32 +1151,14 @@ fn validate_url(
fn validate_signing_alg_values_supported<'a>(
endpoint: &'static str,
values: impl Iterator<Item = &'a JsonWebSignatureAlg>,
mut methods: impl Iterator<Item = &'a OAuthClientAuthenticationMethod>,
) -> Result<(), ProviderMetadataVerificationError> {
let mut no_values = true;

for value in values {
if *value == JsonWebSignatureAlg::None {
return Err(ProviderMetadataVerificationError::SigningAlgValuesWithNone(
endpoint,
));
}

no_values = false;
}

if no_values
&& methods.any(|method| {
matches!(
method,
OAuthClientAuthenticationMethod::ClientSecretJwt
| OAuthClientAuthenticationMethod::PrivateKeyJwt
)
})
{
return Err(ProviderMetadataVerificationError::MissingAuthSigningAlgValues(endpoint));
}

Ok(())
}

Expand Down Expand Up @@ -1543,36 +1500,32 @@ mod tests {
Some(vec![JsonWebSignatureAlg::Rs256, JsonWebSignatureAlg::EdDsa]);
metadata.clone().validate(&issuer).unwrap();

// Err - `client_secret_jwt` without signing alg values.
// Ok - `client_secret_jwt` with signing alg values.
metadata.token_endpoint_auth_methods_supported =
Some(vec![OAuthClientAuthenticationMethod::ClientSecretJwt]);
metadata.token_endpoint_auth_signing_alg_values_supported = None;
let endpoint = assert_matches!(
metadata.clone().validate(&issuer),
Err(ProviderMetadataVerificationError::MissingAuthSigningAlgValues(endpoint)) => endpoint
);
assert_eq!(endpoint, "token_endpoint");

// Ok - `client_secret_jwt` with signing alg values.
metadata.token_endpoint_auth_signing_alg_values_supported =
Some(vec![JsonWebSignatureAlg::Rs256]);
metadata.clone().validate(&issuer).unwrap();

// Err - `private_key_jwt` without signing alg values.
// Ok - `private_key_jwt` with signing alg values.
metadata.token_endpoint_auth_methods_supported =
Some(vec![OAuthClientAuthenticationMethod::PrivateKeyJwt]);
metadata.token_endpoint_auth_signing_alg_values_supported = None;
let endpoint = assert_matches!(
metadata.clone().validate(&issuer),
Err(ProviderMetadataVerificationError::MissingAuthSigningAlgValues(endpoint)) => endpoint
);
assert_eq!(endpoint, "token_endpoint");

// Ok - `private_key_jwt` with signing alg values.
metadata.token_endpoint_auth_signing_alg_values_supported =
Some(vec![JsonWebSignatureAlg::Rs256]);
metadata.clone().validate(&issuer).unwrap();

// Ok - `client_secret_jwt` without signing alg values.
metadata.token_endpoint_auth_methods_supported =
Some(vec![OAuthClientAuthenticationMethod::ClientSecretJwt]);
metadata.token_endpoint_auth_signing_alg_values_supported = None;
metadata.clone().validate(&issuer).unwrap();

// Ok - `private_key_jwt` without signing alg values.
metadata.token_endpoint_auth_methods_supported =
Some(vec![OAuthClientAuthenticationMethod::PrivateKeyJwt]);
metadata.token_endpoint_auth_signing_alg_values_supported = None;
metadata.clone().validate(&issuer).unwrap();

// Ok - Other auth methods without signing alg values.
metadata.token_endpoint_auth_methods_supported = Some(vec![
OAuthClientAuthenticationMethod::ClientSecretBasic,
Expand Down
Loading