Why OpenID Connect let a client initiate authentication for another client

user_12867091 0
Viewed 108

I am using OpenID Connect in Keycloak as an authentication solution and I've just encountered the following scenario.

  • Client A sends an authorisation request to the Authorization server and provide redirect_url of client B in that request.

  • Authorization server authenticate the user and redirect the user to the provided redirect_url(which is for client B) with authentication_code.

  • Client B communicates with Authorization server with its own client_id and secret and takes its token.

I want to know why OpenID Connect has allowed this process, is it a normal thing for a client to initiate authentication for another client? Why the issued authentication_code is not bound to the client who has initiated the authentication and why it the authentication_code can be used by other client with other client_id?

Note: I know that validity of redirection_url will be checked in that process but I want to know why authorization code is not bound to client_id itself.

keycloak oauth-2.0 openid-connect
1 Answers

If it's indeed possible in Keycloak then it's a problem of the implementation, not the spec. The Oauth spec in section 4.1.2. indicates this for the authorization code:

The authorization code is bound to the client identifier and redirection URI.

As for the redirect URI it should also be verified and client A should be able to use redirect URI of client B only if that other redirect URI was whitelisted for client A.

The Proof Key for Code Exchange is also something which would prevent such a use of an Oauth flow as you described here.

user_17122940
Related