feat(server): add OAuth 2.0 dynamic registration (RFC 7591) - #4988
Open
cardoe wants to merge 1 commit into
Open
Conversation
Add a protected RFC 7591 registration endpoint at /register so clients can be provisioned at runtime instead of being preconfigured. Advertise the endpoint through discovery only when it is enabled. Require an initial access token and allow it to be loaded from a named environment variable so deployments can inject it from a secret. Constrain dynamic clients to interactive OIDC grants, registered response types and scopes, and the supported token endpoint authentication method. Reject metadata that would create unusable clients, including registrations without the openid scope and grants outside this endpoint's security model. Static clients retain their existing behavior. Storage records registration policy in every backend through additive schema changes. Redirect URIs, logo URIs, request bodies, and metadata are bounded. Untrusted logos are not rendered, and logs omit secrets and tokens. Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Add a protected RFC 7591 registration endpoint at /register so clients can be provisioned at runtime instead of being preconfigured. Advertise the endpoint through discovery only when it is enabled.
What this PR does / why we need it
RFC 7591 is for dynamic client registration. There have been recent PRs and requests for regex redirect URIs as well as customizing them which is what RFC 7591 achieves. I have a lot of individual nodes that host their own web UI and they support RFC 7591 and managing all their redirect URIs manually would be a chore so I've implemented this for that purpose.
Closes #4383 which I originally looked at but I found it to be incomplete from a testing standpoint and from a security standpoint. I originally started out trying to make a change on top of it but found I was struggling to keep true to the original author and rebase to master. So I started from a fresh branch this implementation.
Special notes for your reviewer
Require an initial access token and allow it to be loaded from a named environment variable so deployments can inject it from a secret. Constrain dynamic clients to interactive OIDC grants, registered response types and scopes, and the supported token endpoint authentication method.
Reject metadata that would create unusable clients, including registrations without the openid scope and grants outside this endpoint's security model. Static clients retain their existing behavior. Storage records registration policy in every backend through additive schema changes.
Redirect URIs, logo URIs, request bodies, and metadata are bounded. Untrusted logos are not rendered, and logs omit secrets and tokens.