From 29d7197161253efb0049a763b672fe5541e79f09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Chalet?= Date: Fri, 5 Jan 2024 16:33:04 +0100 Subject: [PATCH] Add World ID to the list of supported providers --- ...ddictClientWebIntegrationHandlers.Exchange.cs | 16 ++++++++++++++-- .../OpenIddictClientWebIntegrationHandlers.cs | 5 +++-- .../OpenIddictClientWebIntegrationProviders.xml | 13 +++++++++++++ .../OpenIddictValidationConfiguration.cs | 2 +- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Exchange.cs b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Exchange.cs index 110ed2ce..7b3daf2c 100644 --- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Exchange.cs +++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Exchange.cs @@ -66,13 +66,15 @@ public static partial class OpenIddictClientWebIntegrationHandlers // Some providers implement old drafts of the OAuth 2.0 specification that // didn't support the "response_type" parameter but relied on a "type" // parameter to determine the type of request (web server or refresh). - + // + // To support these providers, the "grant_type" parameter must be manually mapped + // to its equivalent "type" (e.g "web_server") before sending the token request. if (context.Registration.ProviderType is ProviderTypes.Basecamp) { context.Request["type"] = context.Request.GrantType switch { GrantTypes.AuthorizationCode => "web_server", - GrantTypes.RefreshToken => "refresh", + GrantTypes.RefreshToken => "refresh", _ => null }; @@ -80,6 +82,16 @@ public static partial class OpenIddictClientWebIntegrationHandlers context.Request.GrantType = null; } + // World ID doesn't support the standard and mandatory redirect_uri parameter and returns + // a HTTP 500 response when specifying it in a grant_type=authorization_code token request. + // + // To prevent that, the redirect_uri parameter must be removed from the token request. + else if (context.GrantType is GrantTypes.AuthorizationCode && + context.Registration.ProviderType is ProviderTypes.WorldId) + { + context.Request.RedirectUri = null; + } + return default; } } diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs index dc80ca9f..0b147af0 100644 --- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs +++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs @@ -597,8 +597,9 @@ public static partial class OpenIddictClientWebIntegrationHandlers context.DisableBackchannelIdentityTokenNonceValidation = context.Registration.ProviderType switch { // These providers don't include the nonce in their identity tokens: - ProviderTypes.Asana or ProviderTypes.Dropbox or - ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline => true, + ProviderTypes.Asana or ProviderTypes.Dropbox or + ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline or + ProviderTypes.WorldId => true, _ => context.DisableBackchannelIdentityTokenNonceValidation }; diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml index 8b6ed0a4..6bb70c38 100644 --- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml +++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml @@ -1395,6 +1395,19 @@ + + + + + +