Implicit ID Token Flow : Confusion

[sharmam-caremonitor]

Hi Team

Please let me know the confusion in using openid-connect client and what is the difference between the two and the preferred way

First way:

Issuer.discover('https:///v2.0/.well-known/openid-configuration') 
  .then(function (oidcIssuer) {
    var client = new oidcIssuer.Client({
      client_id: '1234',
      client_secret: '',
      redirect_uris: ["https://test/login/callback"],
      response_types: ['id_token'], 
      
    });

    passport.use(
      'oidc',
      new Strategy({ client,passReqToCallback: true}, (req, tokenSet, userinfo, done) => {
        console.log("tokenSet",tokenSet);
        console.log("userinfo",userinfo);
        req.session.tokenSet = tokenSet;
        req.session.userinfo = userinfo;
        return done(null, tokenSet.claims());
      }
      
      )
    );
  });

Second way

import { generators } from 'openid-client';
const nonce = generators.nonce();
// store the nonce in your framework's session mechanism, if it is a cookie based solution
// it should be httpOnly (not readable by javascript) and encrypted.

client.authorizationUrl({
  scope: 'openid email profile',
  response_mode: 'form_post',
  nonce,
});

const params = client.callbackParams(req);
const tokenSet = await client.callback('https://client.example.com/callback', params, { nonce });
console.log('received and validated tokens %j', tokenSet);
console.log('validated ID Token claims %j', tokenSet.claims());

Also let me know what is https://client.example.com/callback in second way

[panva]

I don't understand what you're confused about. First one uses passport, the other doesn't. I would prefer not to use passport unless you need to.

what is https://client.example.com/callback in second way

It's the callback url you've registered for your client with the IdP. For implicit flows it may as well be omitted.

[sharmam-caremonitor]

@panva Thanks for the response. I was just asking which one is the better option . Also as per your comments callback url is same as as the one registered as redirected url with the client.

So in my example redirect_uris: ['http://localhost:3000/cb'], So following would be the code to accept request for callback

  router.get('/cb', async (req, res, next) => {

`await client.callback('http://localhost:3000/cb', params, { nonce });` 
});

I have one doubt regrading callback
await client.callback('https://client.example.com/callback', params, { nonce });
Is the state field also get validated apart from nonce in implicit id flow apart from token ?

Also I have same callback for different issuers so is there any way to get the Issuer info in callback ?

[panva]

it's not using state, it's using nonce as you can see in the code.

[sharmam-caremonitor]

Is there way to add custom field check and also I have same callback for different issuers so is there any way to get the Issuer info in callback ?

[panva]

You have to orchestrate this e.g. it by adding the issuer in your callback pathname. It's not the job of a generic client software to know which path of your web framework corresponds to which issuer. Using the same callback path for multiple issues is a common mistake leading to mixup.