feat: add Private Key JWT (private_key_jwt) client authentication - #154
Draft
kishore7snehil wants to merge 1 commit into
Draft
feat: add Private Key JWT (private_key_jwt) client authentication#154kishore7snehil wants to merge 1 commit into
kishore7snehil wants to merge 1 commit into
Conversation
Add private_key_jwt client authentication alongside the existing client secret. When a signing key is configured, the SDK signs a short-lived client assertion (RFC 7523) instead of sending a client secret. Client authentication is resolved in one place and applied uniformly across every token-endpoint call site. Also include the required response_type on Pushed Authorization Requests, which was previously missing and caused the request to be rejected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Changes
This PR adds Private Key JWT (
private_key_jwt) client authentication to auth0-server-python, alongside the existing client secret. When a signing key is configured, the SDK authenticates to the token endpoint by signing a short-lived client assertion (RFC 7523) instead of sending a client secret. Client authentication is resolved in one place and applied uniformly across every token-endpoint call site.✨ Features
client_assertion_signing_keyandclient_assertion_signing_algoptions onServerClientselectprivate_key_jwt; when neither a signing key nor a client secret is configured, token requests raiseConfigurationErrorbefore any network callprivate_key_jwtis applied uniformly across all client-authenticated token requests: authorization code exchange, refresh token, Custom Token Exchange, connection access token (Token Vault), backchannel (CIBA) initiate and grant, PAR, and passkey signinclient_assertionandclient_assertion_typeare rejected from token-exchangeauthorization_params, so the SDK-controlled client assertion cannot be overridden🔧 API Changes
ServerClientoptionclient_assertion_signing_key: Optional[str]- a PKCS8 PEM private key that enablesprivate_key_jwtServerClientoptionclient_assertion_signing_alg: Optional[str]- the assertion signing algorithm, defaulting toRS256build_client_assertion(private_key, client_id, issuer, alg)helper andCLIENT_ASSERTION_TYPEconstant inauth0_server_python.auth_schemes.client_assertionresponse_type, which was previously missing and caused the request to be rejected📖 Documentation
README.md, showing the signing-key configuration and noting that private keys must not be committed to source control🧪 Testing
Contributor Checklist