Handle more than one client secret per client #1712
Description
Is your feature request related to a problem? Please describe.
If we want to rotate a client secret for a specific client, there is no way to have two client secrets in place for a specific time. Without this we have a synchronous dependency between client secret rotation and oauth client modification.
Describe the solution you'd like
We have the idea of adding a client secret struct like this:
type clientSecret struct {
clientSecretId: string,
clientSecret: string,
createdAt: time.Time(),
validFrom: time.Time(),
validUntil: time.Time(),
}and pass this struct to client:
type Client struct {
...
clientSecrets: [2]clientSecret
...
}Describe alternatives you've considered
We have two other ideas, we thought of:
- Adding a second client_secret directly to the client struct
We dislike this idea because we were missing the secret metadata (like validFrom and validUntil) - Make clientSecret in client to a slice of string
Rotation is nearly impossible because we wont know if a client secret is still in use
Additional context
We would love to work on a PR for that after we discussed the design of the feature