Skip to content

Pre-configured OIDC server should use OIDC refresh token grant type #827

@burkel24

Description

@burkel24

Describe the feature

The pre-configured OIDC server class at openid.connect.core.endpoints.pre_configured should use the OIDC-specific RereshTokenGrant defined in openid.connect.core.grant_types.refresh_token.

Additional context

#752 Added an OIDC-specific refresh token grant type, which enables ID tokens to be issued as part of the token refresh flow. The pre-configured OIDC server at oauthlib.openid.connect.core.endpoints.pre_configured, however, does not take advantage of this OIDC-specific grant type (it just uses the regular rfc6749 RefreshTokenGrant instead).

Ultimately, library consumers who wish to issue ID tokens on refresh must create their own custom Server class and a couple properties. As far as I can tell, this process is not documented anywhere and requires digging around in library source code to figure out how to do it.

Intuitively, one would expect the pre-configured OIDC server to use OIDC grant types.

I'm happy to create a PR for this, but could use a bit of guidance re: whether a grant choice dispatcher should be created or not for the refresh token grant type.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions