Implement Client Configuration Endpoint

[ghost]

See: https://openid.net/specs/openid-connect-registration-1_0.html#ClientConfigurationEndpoint

Closes gh-355

[ghost]

hI @jgrandja . After going again through the specification I think that we will also need to touch the client registration logic . The registration_access_token and the registration_client_uri should be generated when the client registration request is processed. (from specs: Authorization Server MUST provide the Client with the fully qualified URL and The Authorization Server MUST NOT expect the Client to construct or discover this URL on its own.)

Should I do it in this PR or would you prefer to raise a new PR/enhancement for this? (after this one is merged)

[jgrandja]

Yes, please enhance OidcClientRegistrationEndpointFilter to return the registration_access_token and registration_client_uri as part of the changes in this PR. Thanks.

[jgrandja]

Thanks for the PR @ovidiupopa91 ! Please see review comments.

[ghost]

Thank you @jgrandja for the review! I've incorporated the changes based on your feedback (and squashed the last commit).

[jgrandja]

Thanks for the updates @ovidiupopa91 !

After a high-level review, I think we should merge the code from OidcClientConfigurationEndpointFilter into OidcClientRegistrationEndpointFilter, as well, merge OidcClientConfigurationAuthenticationProvider into OidcClientRegistrationAuthenticationProvider.

Most of the code in the 2x Filter's and AuthenticationProvider's is the same so let's combine and reuse.

Take a look at a similar implementation in OAuth2AuthorizationEndpointFilter and OAuth2AuthorizationCodeRequestAuthenticationProvider, which handles the Authorization Request (GET) and Authorization Consent (POST).

Thanks for your work!

[ghost]

Hi @jgrandja. I've merged the code into OidcClientRegistrationFilter and OidcClientRegistrationAuthenticationProvider.
The code is ready to be reviewed.

[jgrandja]

Thanks for the updates @ovidiupopa91 ! Please see review comments.

[jgrandja]

Remove this and move tests into OidcClientRegistrationTests

[ghost]

@jgrandja I finished the changes based on your feedback. This should be ready for another review. Thank you!

[jgrandja]

Thanks for the updates @ovidiupopa91. This is now in main!

FYI, I added some polish in order to get this merged.
Please let me know if you have any questions with the updates.

Thanks again for all your work!

[ghost]

hi @jgrandja. No questions from my side.
Please let me know if there is anything else I can help with. Thank you!

[jgrandja]

Appreciate all your help @ovidiupopa91 !
I will get back to you next week with some options for next set of work.
Have a great weekend!

[jgrandja]

Hi @ovidiupopa91. We've had a few issues logged for JdbcOAuth2AuthorizationService as it does not work out of the box with PostgreSQL. Although customization is possible, we should come up with a solution that will make it work by default.

I think we should change the schema from blob to varchar OR another standard SQL datatype that will work with PostgreSQL and most other databases. Would you be able to look into this?

On a side note, I've been working on gh-106 and the attributes varchar(4000) is not long enough when an OAuth2AuthenticationToken is saved under the Principal.class.getName() key. It needed at least 9290 chars so we'll need to fix this as well.

[ghost]

hi @jgrandja. Sure, I can look into this.

[ghost]

@jgrandja I've raised 480 to track this change.