id_token_signed_response_alg must support string[]

[FranciscoKurpiel]

An identity provider may use multiple algorithms to sign the id token issued after an OpenID authentication. This is explicitly allowed in the specification of OpenID Discovery, by having the attribute id_token_signing_alg_values_supported being a string array. There are multiple scenarios where this is necessary, one of which being allowing migration from one algorithm to another without disruption, but there are more.

When a client is declared like this:

  const client = new TrustIssuer.Client({
    client_id: process.env.OAUTH2_CLIENT_LOGIN_CLIENT_ID,
    client_secret: process.env.OAUTH2_CLIENT_LOGIN_CLIENT_SECRET,
    token_endpoint_auth_method: 'client_secret_post',
    id_token_signed_response_alg: "ES512",
  })

It will only accept the specified algorithm. When the identity provider is changed to RSA or EdDSA, the code must support both the old and the new algorithms simultaneously, at least during the transition, and possibly forever. But the documentation and the client library code appears to clearly require id_token_signed_response_alg to be a string, with a single algorithm.

This feature request is change id_token_signed_response_alg to be string | string[], bringing it on pair with the expectations from the general behavior and common practices in OAuth 2.0. Since migration between algorithms is not possible without this feature, it may be classified close the border of feature request and bug.

[panva]

You're describing a behaviour which will be in v6.x of which a beta release is available.

https://github.com/panva/openid-client/blob/v6.0.0-beta.2/docs/interfaces/ClientMetadata.md#id_token_signed_response_alg

[FranciscoKurpiel]

Nice! Is there a chance of back-porting that behavior the the current stable? We're not allowed to use beta versions in production, and we had to hold an upgrade on our ID provider because of this restriction. This is unfortunately holding us back. To my eyes look like changing the attribute from string to string | string[] would not break current users.

[panva]

No, there isn't.

[panva]

https://github.com/panva/openid-client/releases/tag/v6.0.0