Skip to content

Key management overhaul #856

Description

@azmeuk

The different modules ask developers to implement similar methods about key management

  • methods to get the server JWKs (called get_jwks for rfc9068 and the coming rpinitiated , get_jwt_config for OIDC grants, resolve_private_key for OIDC UserInfo endpoint).
  • methods to get server signing/verification algorithms (get_supported_algorithms for UserInfoEndpoint, get_server_registry for the coming rpinitiated)
  • methods to get the client keys (resolve_client_public_key in rfc9101, resolve_client_public_key and resolve_client_key in rfc7523, resolve_public_key in rfc7591)
  • methods to get the client signing algorithms (get_request_object_signing_algorithms in rfc9101)

I think that now that the joserfc has been merged, we should overhaul all of this to make thing clearer and easier:

  • use the same method names everywhere
  • attach server keys / algs management to the AuthorizationServer object, and use them as default (though this is not technically a rfc6749 feature, maybe this can be handled as a AuthorizationServer extension?)
  • allow overloading of keys / algs in the different modules
  • joserfc can easily extract a public key from a private key, so I am not sure that Authlib need to ask for both
  • keep backward compatibility in 1.7 and display a deprecation warning for 1.8
  • get_jwt_config especially feels odd

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions