Problem/Motivation

Current generic implementation assumes there is always an id_token but several flavors of authorization_code flows exist and with the JWT usage id_token flavor is no more mainstream.
This issue is about ensuring id_token value can fallback on access_token value which should be sufficient most of the cases.

Steps to reproduce

Use a flow - or mock it - where id_token is not provided but access_token is valid.

Proposed resolution

In OpenIDConnectionClientBase.php#retrieveTokens, the following lines:

      // Expected result.
      $tokens = [
        'id_token' => isset($response_data['id_token']) ? $response_data['id_token'] : NULL,
        'access_token' => isset($response_data['access_token']) ? $response_data['access_token'] : NULL,
      ];

could become:

      // Expected result.
      $access_token = isset($response_data['access_token']) ? $response_data['access_token'] : NULL;
      $tokens = [
        'id_token' => isset($response_data['id_token']) ? $response_data['id_token'] : $access_token,
        'access_token' => $access_token,
      ];

This does not prevent previously working impl to run properly and flows not providing id_token now work.

Remaining tasks

Apply previous patch :)

User interface changes

None

API changes

None

Data model changes

None

Comments

rmannibucau created an issue. See original summary.

jcnventura’s picture

Status: Active » Needs review

A patch would have been nicer.. But setting it to needs review anyway.

  • jcnventura authored 13edc43 on 2.x
    Issue #3166501 by rmannibucau, jcnventura: Support authorization_code...
jcnventura’s picture

Status: Needs review » Fixed

  • jcnventura authored 0199dfe on 2.x
    Issue #3166501 by jcnventura: Support authorization_code flow without...
jcnventura’s picture

Version: 8.x-1.0-beta6 » 2.x-dev

Setting to the right version where this was addressed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.