feat: add use_oidc_discovery_issuer option for generic OIDC provider#4537
Open
getlarge wants to merge 4 commits intoory:masterfrom
Open
feat: add use_oidc_discovery_issuer option for generic OIDC provider#4537getlarge wants to merge 4 commits intoory:masterfrom
getlarge wants to merge 4 commits intoory:masterfrom
Conversation
Allows the issuer returned by the OpenID Connect Discovery document to differ from the issuer_url used to fetch it, using go-oidc's InsecureIssuerURLContext. This is required for providers like Azure AD B2C where the discovery URL contains the policy name but the issuer in the discovery document and tokens does not. ID Token issuer validation still occurs — tokens are verified against the issuer value from the discovery document. Only the OIDC Discovery §4.3 requirement that the discovery URL must equal the issuer is relaxed. Refs: ory#2404, ory#4005 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Without this, Kratos rejects the field at config validation time since the schema has additionalProperties: false. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Open
4 tasks
Author
|
If you are open to this adjustment, I can add some automated e2e tests. |
InsecureIssuerURLContext stores the passed value as the provider's issuer for token verification. Previously we passed the discovery URL, which caused ID token validation to fail when the token's iss claim differed from the discovery URL. Now we pre-fetch the discovery document to extract the real issuer and pass that to InsecureIssuerURLContext, so token validation uses the correct issuer value. The second fetch by go-oidc's NewProvider is a cache hit (ristretto cache in Ory's go-oidc fork). Also add an e2e test using Hydra that exercises the full registration flow with a mismatched issuer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Closes #4536
Changes
selfservice/strategy/oidc/provider_config.go— addUseOIDCDiscoveryIssuer boolfieldselfservice/strategy/oidc/provider_generic_oidc.go— pre-fetch discovery document to get the real issuer, pass it toInsecureIssuerURLContext, then callNewProviderwith the discovery URLembedx/config.schema.json— adduse_oidc_discovery_issuerto provider schemaselfservice/strategy/oidc/provider_generic_test.go— 3 unit test casesselfservice/strategy/oidc/strategy_test.go— 1 e2e test (full registration flow with Hydra and mismatched issuer)Why pre-fetch the discovery document?
InsecureIssuerURLContextserves two purposes in go-oidc:If we naively pass the discovery URL (e.g.
https://tenant.b2clogin.com/tenant.onmicrosoft.com/policy/v2.0), the provider stores that as its issuer. But the ID token's `iss` claim contains the real issuer from the discovery document (e.g.https://tenant.b2clogin.com/tenant-guid/v2.0/). Token verification then fails with "id token issued by a different provider".So we first fetch the discovery document to extract the real issuer, pass that to
InsecureIssuerURLContext, then letNewProviderdo its normal discovery (which is a cache hit thanks to the ristretto cache in Ory's go-oidc fork).Test plan
🤖 Generated with Claude Code