David Ramos
David Ramos
unfortunately, the [spec](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) defines it as a required field: > REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint [[OpenID.Core]](https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Core). This URL MUST use the `https` scheme and MAY contain...
Hey @Darkrael, thanks for reporting this issue. The [relevant portion](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse) of the spec is: > it SHOULD NOT have a `nonce` Claim, even when the ID Token issued at the...
> if i understand the code correctly, there is no difference between a token gained through refresh and a token gained through the initial authentication flow, where the nonce must...
oh, I forgot `NonceVerifier` is also implemented for [`FnOnce(Option) -> Result`](https://docs.rs/openidconnect/latest/openidconnect/trait.NonceVerifier.html#impl-NonceVerifier-for-F). this means users can just do: ```rust id_token.claims(&id_token_verifier, |_| Ok(())) ``` In that case, I think I'll just mention...
Hey @andrewbaxter, Great points! The provider-side functionality currently offered by this crate is mostly around generating responses (e.g., serializing and signing ID tokens, `StandardTokenResponse`, etc.). To parse requests, I think...
the `EmptyAdditionalClaims` in the error makes me think you're using `CoreClient` or one of the `CoreIdToken*` types somewhere. is it possible `client` is being coerced to a `CoreClient` somewhere after...
I'm not sure what this issue is asking. That looks like an error message being returned by the identity provider, so I'd suggest consulting their documentation or reaching out to...
Hi @wt, Unfortunately, Intuit isn't following the [spec](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig), which is clear about the relationship between the issuer URL and the discovery URL: > OpenID Providers supporting Discovery MUST make a...
> I wonder if there is room for an example that implements this kind of workaround? There aren't currently any examples illustrating a custom HTTP client, and I'd welcome one...
Both crates implement the relevant OAuth2 and OpenID Connect standards. The comparison between those standards and their purposes isn't specific to these Rust crates. There are many blog posts that...