I also added a support for it to our .NET client library. blog post here: http://leastprivilege.com/2016/02/02/pkce-support-in-identityserver-and-identitymodel/
-- Dominick Baier On 2 February 2016 at 09:25:43, Dominick Baier ([email protected]) wrote: IdentityServer 2.4 has PKCE support now as well https://github.com/IdentityServer/IdentityServer3/releases/tag/2.4.0 -- Dominick Baier On 1 February 2016 at 22:12:54, Mike Jones ([email protected]) wrote: Congratulations on your deployment! From: William Denniss [mailto:[email protected]] Sent: Monday, February 1, 2016 12:25 PM To: Mike Jones <[email protected]> Cc: John Bradley <[email protected]>; Nat Sakimura <[email protected]>; [email protected] Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00) We are now live with this change: https://accounts.google.com/.well-known/openid-configuration I'm glad we all reached a consensus on how this param should work, and what it should be called, and thank you Mike for revising the draft! My ask now is that we don't revisit this decision, unless for extremely good reasons, as we don't want to break clients who will start using this. On Mon, Jan 25, 2016 at 4:08 PM, William Denniss <[email protected]> wrote: Thanks Mike, looking forward to the update. I reviewed the other thread. On Mon, Jan 25, 2016 at 2:49 PM, Mike Jones <[email protected]> wrote: I'll add it to the discovery draft in the next day or so. Also, please see my questions in the message "[OAUTH-WG] Discovery document updates planned". I was waiting for that feedback before doing the update. Thanks, -- Mike From: William Denniss Sent: 1/25/2016 2:29 PM To: John Bradley Cc: Nat Sakimura; [email protected]; Mike Jones Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00) OK great! It seems that we have consensus on this. So this is what we plan to add to our discovery doc, based on this discussion: "code_challenge_methods_supported": ["plain","S256"] What are the next steps? Can we we add it to https://tools.ietf.org/html/draft-jones-oauth-discovery directly? I see that the IANA registry created by that draft is "Specification Required", but PKCE is already an RFC without this param being registered. On Mon, Jan 25, 2016 at 2:11 PM, John Bradley <[email protected]> wrote: Yes sorry. code_challenge_method is the query parameter so code_challenge_methods_supported On Jan 25, 2016, at 6:12 PM, William Denniss <[email protected]> wrote: On Thu, Jan 21, 2016 at 6:17 AM, John Bradley <[email protected]> wrote: The code_challenge and code_challenge_method parameter names predate calling the spec PKCE. Given that some of us deployed early versions of PKCE in products and opensource to mitigate the problem before the spec was completed we decided not to rename the parameter names from code_verifier_method to pkce_verifier_method. For consistency we should stick with code_verifier_methods_supported in discovery. To clarify, did you mean "code_challenge_methods_supported"? That is, building on the param name "code_challenge_method" from Section 4.3? John B. On Jan 21, 2016, at 3:12 AM, William Denniss <[email protected]> wrote: "code_challenge_methods_supported" definitely works for me. Any objections to moving forward with that? I would like to update our discovery doc shortly. On Thu, Jan 21, 2016 at 1:37 PM, Nat Sakimura <[email protected]> wrote: Ah, OK. That's actually reasonable. 2016年1月21日(木) 9:31 nov matake <[email protected]>: I prefer “code_challenge_methods_supported”, since the registered parameter name is “code_challenge_method”, not “pkce_method". On Jan 19, 2016, at 11:58, William Denniss <[email protected]> wrote: Seems like we agree this should be added. How should it look? Two ideas: "code_challenge_methods_supported": ["plain", "S256"] or "pkce_methods_supported": ["plain", "S256"] On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <[email protected]> wrote: +1 Am 06.01.2016 um 18:25 schrieb William Denniss: +1 On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <[email protected]> wrote: Good point. Now that PKCE is a RFC we should add it to discovery. John B. > On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <[email protected]> > wrote: > > I just noticed PKCE support is missing from the discovery metadata. > > Is it a good idea to add it? > > Cheers, > > Vladimir > > -- > Vladimir Dzhuvinov > > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
