woggioni
e73c4b2c18
CI / Build Pip package (push) Successful in 8m49s
OIDCClient.validate_id_token compared the iss claim against OIDCConfig.issuer (the discovery URL) instead of the issuer advertised by the provider metadata. This broke Microsoft Entra ID, whose v2 metadata advertises the templated issuer https://login.microsoftonline.com/{tenantid}/v2.0 while tokens carry the concrete tenant GUID, and it also affected tenant-domain issuers. - Validate iss against the discovered metadata issuer and substitute {tenantid} with the token's tid claim. - Catch jwt.PyJWTError in the OIDC callback so invalid tokens return 400 instead of 500 (InvalidIssuerError is not a ValueError). - Re-enable aud/exp/iat/nbf checks for unsigned (alg: none) ID tokens. - Validate ID tokens returned by the refresh grant before storing them, including nonce continuity when present and sub continuity with the session user. - Document Entra ID support and update tests.