-
-
Notifications
You must be signed in to change notification settings - Fork 495
Description
Describe the feature
The pre-configured OIDC server class at openid.connect.core.endpoints.pre_configured
should use the OIDC-specific RereshTokenGrant
defined in openid.connect.core.grant_types.refresh_token
.
Additional context
#752 Added an OIDC-specific refresh token grant type, which enables ID tokens to be issued as part of the token refresh flow. The pre-configured OIDC server at oauthlib.openid.connect.core.endpoints.pre_configured
, however, does not take advantage of this OIDC-specific grant type (it just uses the regular rfc6749 RefreshTokenGrant
instead).
Ultimately, library consumers who wish to issue ID tokens on refresh must create their own custom Server class and a couple properties. As far as I can tell, this process is not documented anywhere and requires digging around in library source code to figure out how to do it.
Intuitively, one would expect the pre-configured OIDC server to use OIDC grant types.
I'm happy to create a PR for this, but could use a bit of guidance re: whether a grant choice dispatcher should be created or not for the refresh token grant type.