Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #14798 The OIDC client plugin should authenticate with BasicAuth when accessing the token endpoint
    Actions
    Infos
    #14798
    Thomas Gerbet (tgerbet)
    2020-04-20 15:19
    2020-04-17 18:49
    16070
    Details
    The OIDC client plugin should authenticate with BasicAuth when accessing the token endpoint
    As of today the plugin passes the client ID and secret in the body of the request. Per the specification [0] the authorization server might not have implemented this way to authenticate so the plugin might be incompatible with some OpenID Connect (Tuleap itself included). Also, the OAuth2 Framework discourages this usage:

    > Including the client credentials in the request-body using the two parameters is NOT RECOMMENDED and SHOULD be limited to clients unable to directly utilize the HTTP Basic authentication scheme (or other password-based HTTP authentication schemes).



    [0] https://tools.ietf.org/html/rfc6749#section-2.3.1
    Authentication & LDAP
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2020-04-20
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #14681 Tuleap Releases 11.14 Delivered 2020-05-03 19:57 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #14798

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/55/18755/1' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD 8419cbe874
    User avatar Joris MASSON (jmasson) , 2020-04-20 15:17
    request #14798: OIDC client plugin uses BasicAuth when accessing the token endpoint 9e07b4959e
    User avatar Thomas Gerbet (tgerbet) , 2020-04-17 19:12
    Referenced by request #14798

    Artifact Tracker v5

    rel #14681 11.14

    Other

    gerrit #18755
    Display settings

    Follow-ups