-
Notifications
You must be signed in to change notification settings - Fork 9.1k
No possibility currently to specify grant-type ciba in OAS #3587
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Are you referring to the I wonder if this field should not be limited by an enum -- the existing supported schemes can have further support in the spec, but allowing any string here would allow for users to make extensions in their own implementations. Or would that potentially break forward compatibility? |
@karenetheridge , Regarding the support of ciba and introducing a new type , i think adding a new one would be not really a good idea, the issue would be that it create a kind of depedency between the OAS spec and the security spec , as the list of flavour can grow not in synch with OAS i wonder if we should not add an field flavours , that is an array of string , so that we can push Ciba and more if we want to be normative , it could provide the URI of the flavour in this array CIBA is one of them but looking on FAPI 2 , the flavours keep growing https://oauth.net/fapi/ |
@LasneF, CIBA is a grant type just like authorization_code. It is not an OIDC flavour. |
@karenetheridge, No, I am referring to the |
@karenetheridge in fact the point you mentionned is valid , and raise questions about how the security scheme in OAS is describe. meaning ciba is not just a grant type but an entire flow , should it be defines inside Oauth2 ?, it could as the other flow but considering that ciba grant type urn:openid:params:grant-type:ciba those are kind of in the middle notice that device code flow could be added too (here as part of Oauth) to me you are raising the capability of discovering the feature supported by a security scheme and the limit OIDC / Oauth2 it make it quite challenging for OAS to follow the request is very valid you want to advertise CIBA flow is supported |
@shilpa-padgaonkar - TODO: create a new PR describing the grant type. |
Camara APIs use the grant type CIBA https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1 and currently have no way to specify it in our OAS files. Could the specification be extended to support the CIBA grant type?
The text was updated successfully, but these errors were encountered: