Is the OIDC client RFC8707 compliant?

[MikaelAnderssonWigander]

In our organisation we use a SIDM as identity provider and they have enabled the RFC8707 on OAuth2 so that we need to provide an additional property in the body; resource Indicator.

Is this enabled somehow in the extension already?

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

@MikaelAnderssonWigander

When requesting tokens, Quarkus does not know where the access token is intended to be forwarded to by the application.

But the resource indicator can be configured.

If you meant the quarkus-oidc extension, for it to add the resource indicator during the authorization code flow, then you can configure it as follows:

quarkus.oidc.authentication.extra-params.resource=https://...

That will add it to the redirect URI as shown in https://www.rfc-editor.org/rfc/rfc8707.html#name-authorization-request.

If this resource must also be included in the code exchange request as shown in https://www.rfc-editor.org/rfc/rfc8707.html#name-access-token-request, then you can add:

quarkus.oidc.code-grant.extra-params.resource=https://...

If you meant the quarkus-oidc-client extension, then you can add for the grant that you use like this:

quarkus.oidc-client.grant-options.client.resource=https://...

For the client credentials, or:

quarkus.oidc-client.grant-options.password.resource=https://...

for the password grant, etc.

Does it answer your question ?

[MikaelAnderssonWigander]

Yes, thanks. We use the client extension on a client_credentials grant type and this was exactly what I was looking for…