oauth2: Reintroduce audience claim

[aeneasr]

It is not possible to set the audience claim in the consent acceptance payload, and it's not possible to retrieve it using the warden API, nor the introspection API. To add it, it must probably be introduced as part of the session.

[someone1]

The session seems to persist the request.Form so maybe this can already be done with slight modification of the challenge session persistence?

If a request comes to the /oauth2/auth handler with an audience URL parameter (in addition to the client_id, state, redirect_uri, etc. like Auth0 does), then this can be persisted in the ConsentRequest and returned as part of the Session.

Side note, it looks like hydra is treating every auth request as an OpenID Connect request? Unless scope=openid is specified, you do not need to force the aud=client_id behavior. All Sessions seem to be represented internally as fosite openid.DefaultSessions. I don't think this impacts anything but was confusing to me as I was trying to use hydra's handlers and wanted to use JWT tokens but got an OpenID token instead.

[someone1]

Depending on how issue #772 is implemented, this might be rolled up into those changes?

[aeneasr]

The session seems to persist the request.Form so maybe this can already be done with slight modification of the challenge session persistence?

Yes, that's the case indeed

If a request comes to the /oauth2/auth handler with an audience URL parameter (in addition to the client_id, state, redirect_uri, etc. like Auth0 does), then this can be persisted in the ConsentRequest and returned as part of the Session.

I'm not quite sure at the moment - is this specified in some spec somewhere? Auth0 is known to bake in some weird custom stuff in their system which is also why they had to basically deprecate all the old APIs.

Side note, it looks like hydra is treating every auth request as an OpenID Connect request? Unless scope=openid is specified, you do not need to force the aud=client_id behavior. All Sessions seem to be represented internally as fosite openid.DefaultSessions. I don't think this impacts anything but was confusing to me as I was trying to use hydra's handlers and wanted to use JWT tokens but got an OpenID token instead.

Kinda, we have handlers which "hook" in functionality based on request parameters. If openid is specified as a scope, an OpenID Connect handler will try to process the request.

Depending on how issue #772 is implemented, this might be rolled up into those changes?

Absolutely