0 Releases 9 Tags

RSS Feed

• release/0.0.7 e73c4b2c18

  Compare

  Validate ID tokens against discovered issuer and refreshed tokens

  woggioni released this 2026-10-01 17:22:00 +02:00 | 3 commits to main since this release

  OIDCClient.validate_id_token compared the iss claim against
  OIDCConfig.issuer (the discovery URL) instead of the issuer advertised by
  the provider metadata. This broke Microsoft Entra ID, whose v2 metadata
  advertises the templated issuer
  https://login.microsoftonline.com/{tenantid}/v2.0 while tokens carry the
  concrete tenant GUID, and it also affected tenant-domain issuers.

  • Validate iss against the discovered metadata issuer and substitute
    {tenantid} with the token's tid claim.
  • Catch jwt.PyJWTError in the OIDC callback so invalid tokens return 400
    instead of 500 (InvalidIssuerError is not a ValueError).
  • Re-enable aud/exp/iat/nbf checks for unsigned (alg: none) ID tokens.
  • Validate ID tokens returned by the refresh grant before storing them,
    including nonce continuity when present and sub continuity with the
    session user.
  • Document Entra ID support and update tests.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)