Support token validation from a Resource Server perspective

[BrendanBall]

Hi

I'm not sure if this is out of scope for this library, but I'm looking to secure a resource server based on OIDC access tokens.
From looking at the docs, I don't think this library currently supports this.
In particular, I'm looking to do offline validation, and since the public key should be retrieved based on the Identity Provider's configuration available at <IdP base url>/.well-known/openid-configuration which is based on the OIDC discovery spec, I think it makes sense to add this functionality to this library. Or maybe there should be a dedicated library for resource servers since the functionality they need is much less.

What are your thoughts?

[maennchen]

@BrendanBall I definitely agree with this. I thought that I already did that in a project, but seem to have used other libraries.

A PR would be very welcome :)

[BrendanBall]

I'm more familiar with Elixir than Erlang, but I'll see what I can do.
Slightly off topic, are there any docs for oidcc v2? I just see an alpha release, but this repo doesn't have a changelog.
I'd like to know what the major changes are.
I've currently been using v1.8 since it's stable, and since I don't know when v2 will be stable, I'll probably want to start with adding this functionality to v1 so I can start using it asap.

EDIT: I see the v2 is just about the http client, so no changes in the library api

[maennchen]

@BrendanBall I'm also not super familiar with Erlang itself. You can just give it a try and I'll be happy to assist.

I bumped to v2 because of the HTTP client and the changed dependencies for TLS certs.

You should be able to use the new major release with almost no changes.

I was also planning to do further cleanups and improvements. (Also re-certify the lib) This is however quite a lot of work and I'll bring that up for some funding in the ERLEF Security WG Meeting.

[maennchen]

Solved in #220

See:

• https://hexdocs.pm/oidcc/3.0.0-alpha.2/oidcc_token.html#validate_id_token/3
• https://hexdocs.pm/oidcc_plug/Oidcc.Plug.ValidateJwtToken.html