oauth2: Expose revocation endpoint at OIDC Discovery (ory#1355)

Closes #12678 Signed-off-by: aeneasr <[email protected]>
dkushner · Apr 11, 2019 · 957a2d6 · 957a2d6
1 parent cb2ad55
commit 957a2d6
Show file tree

Hide file tree

Showing 140 changed files with 535 additions and 287 deletions.
diff --git a/docs/api.swagger.json b/docs/api.swagger.json
diff --git a/oauth2/doc.go b/oauth2/doc.go
@@ -120,6 +120,9 @@ type WellKnown struct {
 
 	// Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support.
 	ClaimsParameterSupported bool `json:"claims_parameter_supported"`
+
+	// URL of the authorization server's OAuth 2.0 revocation endpoint.
+	RevocationEndpoint string `json:"revocation_endpoint"`
 }
 
 // swagger:model flushInactiveOAuth2TokensRequest

diff --git a/oauth2/handler.go b/oauth2/handler.go
@@ -112,6 +112,7 @@ func (h *Handler) WellKnownHandler(w http.ResponseWriter, r *http.Request) {
 		AuthURL:                           urlx.AppendPaths(h.c.IssuerURL(), AuthPath).String(),
 		TokenURL:                          urlx.AppendPaths(h.c.IssuerURL(), TokenPath).String(),
 		JWKsURI:                           urlx.AppendPaths(h.c.IssuerURL(), JWKPath).String(),
+		RevocationEndpoint:                urlx.AppendPaths(h.c.IssuerURL(), RevocationPath).String(),
 		RegistrationEndpoint:              h.c.OAuth2ClientRegistrationURL().String(),
 		SubjectTypes:                      h.c.SubjectTypesSupported(),
 		ResponseTypes:                     []string{"code", "code id_token", "id_token", "token id_token", "token", "token id_token code"},

diff --git a/oauth2/handler_test.go b/oauth2/handler_test.go
@@ -394,6 +394,7 @@ func TestHandlerWellKnown(t *testing.T) {
 		AuthURL:                           urlx.AppendPaths(conf.IssuerURL(), oauth2.AuthPath).String(),
 		TokenURL:                          urlx.AppendPaths(conf.IssuerURL(), oauth2.TokenPath).String(),
 		JWKsURI:                           urlx.AppendPaths(conf.IssuerURL(), oauth2.JWKPath).String(),
+		RevocationEndpoint:                urlx.AppendPaths(conf.IssuerURL(), oauth2.RevocationPath).String(),
 		RegistrationEndpoint:              conf.OAuth2ClientRegistrationURL().String(),
 		SubjectTypes:                      []string{"pairwise", "public"},
 		ResponseTypes:                     []string{"code", "code id_token", "id_token", "token id_token", "token", "token id_token code"},

diff --git a/sdk/go/hydra/models/authentication_request.go b/sdk/go/hydra/models/authentication_request.go
diff --git a/sdk/go/hydra/models/authentication_session.go b/sdk/go/hydra/models/authentication_session.go
diff --git a/sdk/go/hydra/models/client.go b/sdk/go/hydra/models/client.go
diff --git a/sdk/go/hydra/models/consent_request.go b/sdk/go/hydra/models/consent_request.go
diff --git a/sdk/go/hydra/models/consent_request_session_data.go b/sdk/go/hydra/models/consent_request_session_data.go
diff --git a/sdk/go/hydra/models/empty_response.go b/sdk/go/hydra/models/empty_response.go
diff --git a/sdk/go/hydra/models/flush_inactive_o_auth2_tokens_request.go b/sdk/go/hydra/models/flush_inactive_o_auth2_tokens_request.go
diff --git a/sdk/go/hydra/models/generic_error.go b/sdk/go/hydra/models/generic_error.go
diff --git a/sdk/go/hydra/models/handled_consent_request.go b/sdk/go/hydra/models/handled_consent_request.go
diff --git a/sdk/go/hydra/models/handled_login_request.go b/sdk/go/hydra/models/handled_login_request.go
diff --git a/sdk/go/hydra/models/introspection.go b/sdk/go/hydra/models/introspection.go
diff --git a/sdk/go/hydra/models/login_request.go b/sdk/go/hydra/models/login_request.go
diff --git a/sdk/go/hydra/models/open_id_connect_context.go b/sdk/go/hydra/models/open_id_connect_context.go
diff --git a/sdk/go/hydra/models/previous_consent_session.go b/sdk/go/hydra/models/previous_consent_session.go
diff --git a/sdk/go/hydra/models/request_denied_error.go b/sdk/go/hydra/models/request_denied_error.go
diff --git a/sdk/go/hydra/models/request_handler_response.go b/sdk/go/hydra/models/request_handler_response.go
diff --git a/sdk/go/hydra/models/swagger_flush_inactive_access_tokens.go b/sdk/go/hydra/models/swagger_flush_inactive_access_tokens.go
diff --git a/sdk/go/hydra/models/swagger_json_web_key_query.go b/sdk/go/hydra/models/swagger_json_web_key_query.go
diff --git a/sdk/go/hydra/models/swagger_jwk_create_set.go b/sdk/go/hydra/models/swagger_jwk_create_set.go
diff --git a/sdk/go/hydra/models/swagger_jwk_set_query.go b/sdk/go/hydra/models/swagger_jwk_set_query.go
diff --git a/sdk/go/hydra/models/swagger_jwk_update_set.go b/sdk/go/hydra/models/swagger_jwk_update_set.go
diff --git a/sdk/go/hydra/models/swagger_jwk_update_set_key.go b/sdk/go/hydra/models/swagger_jwk_update_set_key.go
diff --git a/sdk/go/hydra/models/swagger_o_auth_introspection_request.go b/sdk/go/hydra/models/swagger_o_auth_introspection_request.go
diff --git a/sdk/go/hydra/models/swagger_revoke_o_auth2_token_parameters.go b/sdk/go/hydra/models/swagger_revoke_o_auth2_token_parameters.go
diff --git a/sdk/go/hydra/models/swaggeroauth2_token_parameters.go b/sdk/go/hydra/models/swaggeroauth2_token_parameters.go
diff --git a/sdk/go/hydra/models/well_known.go b/sdk/go/hydra/models/well_known.go
diff --git a/sdk/java/hydra-client-resttemplate/README.md b/sdk/java/hydra-client-resttemplate/README.md
@@ -163,6 +163,7 @@ Class | Method | HTTP request | Description
  - [SwaggerFlushInactiveAccessTokens](docs/SwaggerFlushInactiveAccessTokens.md)
  - [SwaggerHealthStatus](docs/SwaggerHealthStatus.md)
  - [SwaggerJSONWebKey](docs/SwaggerJSONWebKey.md)
+ - [SwaggerJSONWebKeyQuery](docs/SwaggerJSONWebKeyQuery.md)
  - [SwaggerJSONWebKeySet](docs/SwaggerJSONWebKeySet.md)
  - [SwaggerJsonWebKeyQuery](docs/SwaggerJsonWebKeyQuery.md)
  - [SwaggerJwkCreateSet](docs/SwaggerJwkCreateSet.md)

diff --git a/sdk/java/hydra-client-resttemplate/docs/AuthenticationSession.md b/sdk/java/hydra-client-resttemplate/docs/AuthenticationSession.md
@@ -4,7 +4,7 @@
 ## Properties
 Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
-**authenticatedAt** | [**DateTime**](DateTime.md) | authenticated at Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
+**authenticatedAt** | [**DateTime**](DateTime.md) | authenticated at Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
 **ID** | **String** | ID |  [optional]
 **subject** | **String** | subject |  [optional]
 

diff --git a/sdk/java/hydra-client-resttemplate/docs/Client.md b/sdk/java/hydra-client-resttemplate/docs/Client.md
@@ -12,7 +12,7 @@ Name | Type | Description | Notes
 **clientSecretExpiresAt** | **Long** | SecretExpiresAt is an integer holding the time at which the client secret will expire or 0 if it will not expire. The time is represented as the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time of expiration. |  [optional]
 **clientUri** | **String** | ClientURI is an URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion. |  [optional]
 **contacts** | **List&lt;String&gt;** | Contacts is a array of strings representing ways to contact people responsible for this client, typically email addresses. |  [optional]
-**createdAt** | [**DateTime**](DateTime.md) | CreatedAt returns the timestamp of the client&#39;s creation. Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
+**createdAt** | [**DateTime**](DateTime.md) | CreatedAt returns the timestamp of the client&#39;s creation. Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
 **grantTypes** | **List&lt;String&gt;** | GrantTypes is an array of grant types the client is allowed to use. |  [optional]
 **jwks** | [**SwaggerJSONWebKeySet**](SwaggerJSONWebKeySet.md) |  |  [optional]
 **jwksUri** | **String** | URL for the Client&#39;s JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client&#39;s encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key&#39;s intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate. |  [optional]
@@ -28,7 +28,7 @@ Name | Type | Description | Notes
 **subjectType** | **String** | SubjectType requested for responses to this Client. The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include &#x60;pairwise&#x60; and &#x60;public&#x60;. |  [optional]
 **tokenEndpointAuthMethod** | **String** | Requested Client Authentication method for the Token Endpoint. The options are client_secret_post, client_secret_basic, private_key_jwt, and none. |  [optional]
 **tosUri** | **String** | TermsOfServiceURI is a URL string that points to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client. |  [optional]
-**updatedAt** | [**DateTime**](DateTime.md) | UpdatedAt returns the timestamp of the last update. Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
+**updatedAt** | [**DateTime**](DateTime.md) | UpdatedAt returns the timestamp of the last update. Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time Format: date-time |  [optional]
 **userinfoSignedResponseAlg** | **String** | JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type. |  [optional]
 
 

diff --git a/sdk/java/hydra-client-resttemplate/docs/PreviousConsentSession.md b/sdk/java/hydra-client-resttemplate/docs/PreviousConsentSession.md
@@ -9,7 +9,7 @@ Name | Type | Description | Notes
 **grantScope** | **List&lt;String&gt;** | GrantScope sets the scope the user authorized the client to use. Should be a subset of &#x60;requested_scope&#x60; |  [optional]
 **remember** | **Boolean** | Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope. |  [optional]
 **rememberFor** | **Long** | RememberFor sets how long the consent authorization should be remembered for in seconds. If set to &#x60;0&#x60;, the authorization will be remembered indefinitely. |  [optional]
-**session** | [**ConsentRequestSession**](ConsentRequestSession.md) |  |  [optional]
+**session** | [**ConsentRequestSessionData**](ConsentRequestSessionData.md) |  |  [optional]
 
 
 
diff --git a/sdk/java/hydra-client-resttemplate/docs/SwaggerJwkCreateSet.md b/sdk/java/hydra-client-resttemplate/docs/SwaggerJwkCreateSet.md
@@ -4,7 +4,7 @@
 ## Properties
 Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
-**body** | [**CreateRequest**](CreateRequest.md) |  |  [optional]
+**body** | [**JsonWebKeySetGeneratorRequest**](JsonWebKeySetGeneratorRequest.md) |  |  [optional]
 **set** | **String** | The set in: path |