Has the default grant type changed? about identitymodel.oidcclient

[thomasbach-dk]

It works disabling PAR by setting DisablePushedAuthorization to true.

And you are right - we´re running KeyCloak version 22.0.5 and will look into an update.

Thanks for rapid response @josephdecock

[Euclidite]

I'm seeing the same issue on my end - v5.2.1 I was able to successfully kick of authentication with Okta, and now with v6.0.0 LoginAsync throws the error Unauthorized - Failed to push authorization parameters

[josephdecock]

@Euclidite - you can actually add additional base URLs as valid for the other endpoints in the discovery policy.

[josephdecock]

Hi folks - new in v6 we added support for pushed authorization, and we enable it by default when discovery indicates that it is supported by the identity provider. You can disable pushed authorization with the DisablePushedAuthorization flag on OidcClientOptions. We need to do some more investigating to understand why pushed authorization is failing, but as a first step, can you try flipping that flag please?

[josephdecock]

Oh, and I should say that no, the default grant type didn't change. It looks like the error in both cases is the same. @Euclidite - is your client a public client too (we can see that @thomasbach-dk's client is, because there is no client authentication (no secret or assertion))?

[josephdecock]

@thomasbach-dk - I'm looking at keycloak/keycloak#8939 and apparently older builds of keycloak didn't allow public clients to use PAR, but newer builds do. Check to see what version of keycloak you're using- if you're pre 23.0.0 then either update it or disable PAR in the IdentityModel options.

[josephdecock]

@Euclidite - do you know if okta prevents public clients from pushing authorization?

[Euclidite]

Thanks for the quick response @josephdecock ! I tested with PAT disabled and the request worked:

var options = new OidcClientOptions
{
    Authority = "https://dev-123456.okta.com/oauth2/default",
    ClientId = clientId,
    Scope = "openid profile offline_access",
    RedirectUri = "http://127.0.0.1/okta-sign-in-success",
    Browser = authWindow,
    DisablePushedAuthorization = true,
    Policy = new Policy
    {
        RequireIdentityTokenSignature = false,
        Discovery = new DiscoveryPolicy
        {
            // https://devforum.okta.com/t/error-loading-discovery-document-endpoint-belongs-to-different-authority/6582
            EndpointValidationExcludeList = ["registration_endpoint"]
        }
    }
};

As for Okta & PAR - it looks like it supports it, but my feeling is that because of how Okta expects URLs to be built (https://developer.okta.com/docs/reference/api/oidc/#par) this may not work out of the box - it's the same reason I had to exclude validation of the registration endpoint - it looks like Okta responds with just the base URL and the client throws an error Message = "Error loading discovery document: Invalid base address for endpoint https://dev-123456.okta.com/oauth2/v1/clients. Valid base addresses: https://dev-123456.okta.com/oauth2/default.".

For context, in Okta I'm using a custom authorization within my Okta domain to allow creation of custom claims for my application.