Advice on using with Azure B2C OIDC, which lacks the OpenID configuration key code_challenge_methods_supported

[Nezteb]

Description

In the case of Azure B2C's OIDC implementation, configuration objects do not contain valid PKCE configuration for the code challenge method.

However, the docs also suggest that the method will always be S256.

Example OpenID configuration:

{
  "token_endpoint": "https://login.microsoftonline.com/REDACTED_TENANT_ID/oauth2/v2.0/token",
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "private_key_jwt",
    "client_secret_basic"
  ],
  "jwks_uri": "https://login.microsoftonline.com/REDACTED_TENANT_ID/discovery/v2.0/keys",
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "subject_types_supported": [
    "pairwise"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "response_types_supported": [
    "code",
    "id_token",
    "code id_token",
    "id_token token"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "issuer": "https://login.microsoftonline.com/REDACTED_TENANT_ID/v2.0",
  "request_uri_parameter_supported": false,
  "userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo",
  "authorization_endpoint": "https://login.microsoftonline.com/REDACTED_TENANT_ID/oauth2/v2.0/authorize",
  "device_authorization_endpoint": "https://login.microsoftonline.com/REDACTED_TENANT_ID/oauth2/v2.0/devicecode",
  "http_logout_supported": true,
  "frontchannel_logout_supported": true,
  "end_session_endpoint": "https://login.microsoftonline.com/REDACTED_TENANT_ID/oauth2/v2.0/logout",
  "claims_supported": [
    "sub",
    "iss",
    "cloud_instance_name",
    "cloud_instance_host_name",
    "cloud_graph_host_name",
    "msgraph_host",
    "aud",
    "exp",
    "iat",
    "auth_time",
    "acr",
    "nonce",
    "preferred_username",
    "name",
    "tid",
    "ver",
    "at_hash",
    "c_hash",
    "email"
  ],
  "kerberos_endpoint": "https://login.microsoftonline.com/REDACTED_TENANT_ID/kerberos",
  "tenant_region_scope": "EU",
  "cloud_instance_name": "microsoftonline.com",
  "cloud_graph_host_name": "graph.windows.net",
  "msgraph_host": "graph.microsoft.com",
  "rbac_url": "https://pas.windows.net"
}

Note the lack of a code_challenge_methods_supported key, which results in oidcc always returning a no_supported_code_challenge error tuple. Relevant oidcc code here.

Since oidcc doesn't (yet) support implicit/hybrid flows, is there a way I can work around this limitation of Azure's OIDC offering? Perhaps a way of providing a configuration option in oidcc_authorization.opts()?

Any advice is appreciated. 🙏

[maennchen]

@Nezteb In cases where the Introspection is incorrect, the document_overrides option of the quirks can be set to override the values.

Assuming you're using oidcc_provider_configuration_worker:

{ok, Pid} = oidcc_provider_configuration_worker:start_link(#{
  issuer => "...",
  provider_configuration_opts =>#{
    quirks => #{
      document_overrides => #{
        <<"code_challenge_methods_supported">> => [<<"S256">>]
      }
    }
  }
}

[Nezteb]

Ahh, thank you for the info! I will use this.