Repository navigation
feat: accept OAuth JWT access tokens in the test server - #48
Merged
Merged
Conversation
Documentation build overview
4 files changed± changelog.html± genindex.html± reference/cli.html± _modules/scim2_server/applications/base.html |
The --oauth-issuer and --oauth-audience options accept the JWT access tokens of RFC 9068, and announce the oauth2 scheme. The keys come from the jwks_uri of the issuer metadata (RFC 8414, then OpenID Connect Discovery), or from --oauth-jwks-uri. --oauth-scope requires a scope. Errors follow RFC 6750 §3: 401 with invalid_token, 403 with insufficient_scope, and no error code without a token. The options need the new oauth extra, which the container image installs. StaticCredentialsApplication is renamed CredentialsApplication.
…y a token is refused When the metadata or the keys of the issuer cannot be downloaded or read, the test server answers 503 with a Retry-After header, instead of 500. Per RFC 9110 §15.6.4, the client can send the request again later. The detail of a 401 gives the reason a token is refused, such as an invalid aud claim or an expired token. The detail of a 403 gives the missing scope.
azmeuk
force-pushed
the
oauth-resource-server
branch
from
November 12, 2026 16:01
b0d14bd to
fd57d0e
Compare
azmeuk
marked this pull request as ready for review
November 12, 2026 16:01
azmeuk
enabled auto-merge
November 12, 2026 16:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
--oauth-issuerand--oauth-audienceoptions accept the JWT access tokens of RFC 9068, and announce the oauth2 scheme. The keys come from the jwks_uri of the issuer metadata (RFC 8414, then OpenID Connect Discovery), or from--oauth-jwks-uri.--oauth-scoperequires a scope.