OpenID Hybrid Code Flow Support

[yasithdev]

Hi There,

I'm trying to connect to an OpenID server using this library, but facing an issue where the server only supports the hybrid flow i.e. "code id_token" flow. But I couldn't find any way to set the response_type from the library. Do you have any idea how this can be done?

[kadikraman]

Hi, we currently only use code, but I think it would be pretty straightforward to support the hybrid flow. Perhaps we should add a useHybridFlow parameter in the config? 🤔

[frostless]

+1 just tested, does not seem to support hybrid

const config = {
  issuer: 'https://demo.identityserver.io',
  clientId: 'native.hybrid',
  redirectUrl: 'io.identityserver.demo:/oauthredirect',
  additionalParameters: {},
  scopes: ['openid', 'profile', 'email', 'offline_access']
};

would got this invalid grant type for client

[ryanmendoza]

@kadikraman wouldn't it make more sense to have a flow parameter in the config (default set to authorization_code)? There are more flows than just authorization_code and hybrid.

[garrettm]

Has any progress been made on this?

[Jay-A-McBee]

👋 Hey everyone,
I've been looking into hybrid flow support and it looks like the backing native library AppAuth only has support for iOS (openid/AppAuth-iOS#298). There is discussion around the topic in their Android lib, but the issue hasn't seen any movement in a couple years (openid/AppAuth-Android#75). As we'd like to keep our iOS and Android implementations in parity with one another, we're currently blocked on this until AppAuth supports both platforms.

[djdance]

I came from iOS AppAuth with the same issue and was very surprised. Subscribe.

[kevvurs]

I've been working with an Android app that does hybrid flow with AppAuth Android. Would you accept a PR for response_type: "code id_token" as a configuration option?

[blundell]

got a ping and noticed this thread without a conclusion, for anyone else looking I implemented hybrid here: blundell/AppAuth-Android@e9986e4 (so you could do it too)