Add request setting to oauth providers authorization setting

[valstu]

Description 📓

Related to conversation on this PR #2411
#2411 (comment)

I don't know how common it is but sometimes it might be needed to modify the initial authorization request. In my case I need to do exactly that.

Usually the initial authorization request is something like this:
GET/POST /oauth/authorize with parameters like

{
  "client_id": 12345,
  "redirect_uri": "/something/oauth",
  "scope": "profile",
  "response_type": "code"
 }

I'm using this Finnish 🇫🇮 Strong Customer Authentication Provider which requires that these parameters aren't sent as "plain text". What I need to do is take the params and sign them with signing key and basically turn them into this encrypted value. Something like this:

const params = {
 redirect_uri: `http://localhost:300/api/auth/callback/sca`,
 scope: 'profile',
 client_id: '12345667',
 response_type: 'code'
};
const keyFile = fs.readFileSync("keys/sp-signing-key.pem").toString();
const signingKey = await jose.JWK.asKey(keyFile, "pem");
const request = await jose.JWS.createSign({ format: "compact" }, signingKey).update(JSON.stringify(params), "utf-8").final();

After generating the request variable I need send that with initial authorization call something like this:
GET /oauth/authorize?request=${request}

Like I said, I don't know if this is common with other Service Providers but I would like have some insight if other users would benefit from having the request setting included in authorization settings as well.

For now, I can probably do some kind of workaround where I pregenerate the initial request value since it shoudln't change that often, the key that I'm using for signing the value is dynamic so I just have to make sure it will always use the latest one.

I just tried out the new request settings with userinfo and token settings and those seems to work nice! I guess I don't have to monkey patch next-auth anymore to get these specific identity providers working.

How to reproduce ☕️

Lets add some examples later if this feature is needed

Contributing 🙌🏽

Yes, I am willing to help implement this feature in a PR

[balazsorban44]

Thank you for explaining your request! I'll try to have a look at it. Currently, we are trying to get v4 over the fin(n)ish line and release it as stable. So any new feature requests might have to wait a bit, but I am sure this can be implemented nicely as well.

FYI, if you need to set something dynamically, remember that NextAuth can be used like this as well:

export default async function auth(req, res) {
  // Do anything dynamic here
  return await NextAuth(req, res, {
    ...
  })
}

[valstu]

Yeah, totally understand! Lets see if this gains popularity and them make actions based on that.

FYI, if you need to set something dynamically, remember that NextAuth can be used like this as well

Actually I just did what you suggested few hours ago and that will probably work out fine. 👍

[balazsorban44]

I wonder if #2717 would help here!

exposing https://github.com/panva/node-openid-client/blob/main/docs/README.md#new-clientmetadata-jwks-options

means you could set jwks

[stale]

Hi there! It looks like this issue hasn't had any activity for a while. It will be closed if no further activity occurs. If you think your issue is still relevant, feel free to comment on it to keep it open. (Read more at #912) Thanks!

[balazsorban44]

#2717 has been merged so there is a jwks option now. Kindly report if that helps. If not, and you have a feature request, I could re-open this.

[hyusetiawan]

Thank you for explaining your request! I'll try to have a look at it. Currently, we are trying to get v4 over the fin(n)ish line and release it as stable. So any new feature requests might have to wait a bit, but I am sure this can be implemented nicely as well.

FYI, if you need to set something dynamically, remember that NextAuth can be used like this as well:

export default async function auth(req, res) {
  // Do anything dynamic here
  return await NextAuth(req, res, {
    ...
  })
}

should have known that this is possible before venturing out on a custom solution damn