Re: [PoC] Federated Authn/z with OAUTHBEARER

Hi Jacob, thank you for detailed explanation and links!

Am I right that classic OAuth flow "create user account based on a 
token" is implemented using custom validators?

1) In pg_hba.conf set user to all and  "delegate_ident_mapping=1"

"local all all oauth issuer=$issuer scope=$scope delegate_ident_mapping=1"

2) Write a custom validator that will "execute" in C `CREATE USER 
token.name WITH token.listofOptions` after verification of a token.

On 25-04-21 19:57, Jacob Champion wrote:
> We have some options for dealing with them, since their documentation
> instructs clients to hardcode their API entry points instead of using
> discovery. (That makes it easy for us to figure out when we're talking
> to Google, and potentially switch to a quirks mode.)

What do you mean by "discovery"? OpenID link that returns endpoint?

Google has this link

https://accounts.google.com/.well-known/openid-configuration

OUTPUT:
     {
         "issuer": "https://accounts.google.com",
         "authorization_endpoint": 
"https://accounts.google.com/o/oauth2/v2/auth",
         "device_authorization_endpoint": 
"https://oauth2.googleapis.com/device/code",
         "token_endpoint": "https://oauth2.googleapis.com/token",
         "userinfo_endpoint": 
"https://openidconnect.googleapis.com/v1/userinfo",
         "revocation_endpoint": "https://oauth2.googleapis.com/revoke",
         "jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
............
     }

Here it's described

https://developers.google.com/identity/openid-connect/openid-connect

> But! Before we do that: How do you intend to authorize tokens issued
> by Google? Last I checked, they still had no way to register an
> application-specific scope, making it very dangerous IMO to use a
> public flow [2].

I've also thought as Antonin about 
https://www.googleapis.com/oauth2/v3/userinfo for verification

As I understand from [2], the current problem is security, Google 
doesn't want to add new scopes.

-- 
Best wishes,
Ivan Kush
Tantor Labs LLC