The different modules ask developers to implement similar methods about key management
- methods to get the server JWKs (called
get_jwks for rfc9068 and the coming rpinitiated , get_jwt_config for OIDC grants, resolve_private_key for OIDC UserInfo endpoint).
- methods to get server signing/verification algorithms (
get_supported_algorithms for UserInfoEndpoint, get_server_registry for the coming rpinitiated)
- methods to get the client keys (
resolve_client_public_key in rfc9101, resolve_client_public_key and resolve_client_key in rfc7523, resolve_public_key in rfc7591)
- methods to get the client signing algorithms (
get_request_object_signing_algorithms in rfc9101)
I think that now that the joserfc has been merged, we should overhaul all of this to make thing clearer and easier:
- use the same method names everywhere
- attach server keys / algs management to the
AuthorizationServer object, and use them as default (though this is not technically a rfc6749 feature, maybe this can be handled as a AuthorizationServer extension?)
- allow overloading of keys / algs in the different modules
- joserfc can easily extract a public key from a private key, so I am not sure that Authlib need to ask for both
- keep backward compatibility in 1.7 and display a deprecation warning for 1.8
get_jwt_config especially feels odd
The different modules ask developers to implement similar methods about key management
get_jwksfor rfc9068 and the coming rpinitiated ,get_jwt_configfor OIDC grants,resolve_private_keyfor OIDC UserInfo endpoint).get_supported_algorithmsfor UserInfoEndpoint,get_server_registryfor the coming rpinitiated)resolve_client_public_keyin rfc9101,resolve_client_public_keyandresolve_client_keyin rfc7523,resolve_public_keyin rfc7591)get_request_object_signing_algorithmsin rfc9101)I think that now that the joserfc has been merged, we should overhaul all of this to make thing clearer and easier:
AuthorizationServerobject, and use them as default (though this is not technically a rfc6749 feature, maybe this can be handled as a AuthorizationServer extension?)get_jwt_configespecially feels odd