RFC8707 - Possible Missing Multiple Resources handling for Code Flow Authorization Request

Hello,

My question might be totally naive, but here I go: We have an SSO from which we’re gettings Access/Refresh/Id token in order to later call 2 Services. We’re trying to add the resource information as part of the AuthCode Grant during signing in order to generate dedicated token(s ?) to hit both ApiOne and ApiTwo. (see image above from the RFC) RFC 8707 - Resource Indicators for OAuth 2.0

(On refresh the same will apply by sending the last valid refresh token + the appropriate resources)

My question being … how can this be achieved with the library today for both SignIn, Refresh, etc … From the OidcClient.ts resource seems to be a simple string here: https://github.com/authts/oidc-client-ts/blob/0e6bfc22ba2181bf52934b1666ac61d9a0a92069/src/OidcClient.ts#L37

and it seems to be forwarded https://github.com/authts/oidc-client-ts/blob/0e6bfc22ba2181bf52934b1666ac61d9a0a92069/src/OidcClient.ts#L111

And I cannot find the could mapping that to the &resource=

[tebeco]

thx @pamapa the assigned dev here was not able to test the change, I notice that I forgot to ping you back last time

Thx for having merging it in the meanwhile 😉

I’ll try to keep you posted anyway later on

[pamapa]

@tebeco About invalid resources: I would say shit in shit out: The resource is coming directly from the developer.

I think its better to just check for Array.isArray(resource):

// https://datatracker.ietf.org/doc/html/rfc8707
const resources = Array.isArray(resource) ? resource : [resource]
resources
  .forEach(r => parsedUrl.searchParams.append("resource", r));