skipIssuerCheck flag is ignored

I ran into an issue where configuring the library without a discovery document causes an wrong issuer error to be thrown even though skipIssuerCheck is true.

Error validating tokens angular-oauth2-oidc.js:1183
Wrong issuer: https://login.microsoftonline.com/cba9e115-3016-4462-a1ab-a565cba0cdf1/v2.0 angular-oauth2-oidc.js:1184
ERROR Error: "Uncaught (in promise): Wrong issuer: https://login.microsoftonline.com/cba9e115-3016-4462-a1ab-a565cba0cdf1/v2.0"

export const config: AuthConfig = {
    clientId: '<redacted>',
    redirectUri: window.location.origin,
    skipIssuerCheck: true,
    scope: 'openid profile email',
    
    issuer: 'https://login.microsoftonline.com/common/v2.0',
    loginUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
    logoutUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/logout',
    tokenEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
    userinfoEndpoint: 'https://graph.microsoft.com/oidc/userinfo',
};

@Injectable()
export class AuthenticationService {
    
    private service: OAuthService;
    
    
    constructor(service: OAuthService) {
        this.service = service;
        this.service.configure(config);
        this.service.tokenValidationHandler = new JwksValidationHandler();
    }

    
    login(): void {
        if (!this.service.hasValidAccessToken()) {
            this.service.tryLogin().then(() => {
                this.service.initImplicitFlow();
            });
        }
    }   
    
}

[jeroenheijmans]

Looking at the code, this might be intentional (if I read/understand it right). The skipIssuerCheck only does this:

https://github.com/manfredsteyer/angular-oauth2-oidc/blob/0274cf5c03080e2a139abbf84d2bb9dd2480f3c2/projects/lib/src/oauth-service.ts#L480-L490

The error you describe is thrown here, inside the processIdToken(...) method:

https://github.com/manfredsteyer/angular-oauth2-oidc/blob/0274cf5c03080e2a139abbf84d2bb9dd2480f3c2/projects/lib/src/oauth-service.ts#L1503-L1506

Not sure if this was intentional or is a bug, but either way there seems to be no way to skip validation of the issuer mentioned in the processIdToken(...) method.

If you’d want that, the only things to do seem to be:

• change the behavior and check the flag in the second case too
• add a new flag for the second instance

Not sure from the top of my head if it makes sense to have the check only in one case, someone else might chip in on that.

[ismcagdas]

Done, https://github.com/manfredsteyer/angular-oauth2-oidc/pull/527