Add NetSuite Provider

[antonypetras]

This PR adds support for Oracle NetSuite as a provider.

Quirks

• expires_in returned in non-standard string format
• id_token not always returned
• at_hash not constructed correctly
• introspection response contains scope as an array of strings

After much poking around I decided a new handler for the introspection response was required. Hopefully that is correct 😎

Other fun notes for future readers

• refresh_token grant only returns an additional refresh token when the client is configured as public in NetSuite and is valid for 3 hours only
• revoke requires that token is a refresh token and will not work otherwise

Docs

[kevinchalet]

Thanks for your great PR! ❤️

If we can merge it this morning, it will ship as part of the OpenIddict 7.0 release 😃

[kevinchalet]

After much poking around I decided a new handler for the introspection response was required. Hopefully that is correct 😎

No, that's perfect! 👍🏻

refresh_token grant only returns an additional refresh token when the client is configured as public in NetSuite and is valid for 3 hours only

Out of curiosity, does that imply that for confidential clients, they don't use refresh tokens at all and issue access tokens that never expire?

[antonypetras]

Thanks for making it so easy to contribute with such good docs.

Out of curiosity, does that imply that for confidential clients, they don't use refresh tokens at all and issue access tokens that never expire?

All access tokens are valid for 60 minutes.

• For confidential clients your original refresh token is valid for 7 days. Once you use the refresh token once, you get another access token that is valid for 60 minutes (no refresh token) and then you're done.
• For public clients your refresh tokens are only valid for 3 hours, but you can cycle through refresh tokens forever

NetSuite is one of those systems that logs you out of the UI constantly and I guess they want to pass that on downstream.

[kevinchalet]

Thanks for making it so easy to contribute with such good docs.

❤️

Once you use the refresh token once, you get another access token that is valid for 60 minutes (no refresh token) and then you're done.

🔫 ... yeah, that's really stupid 😄

Merged, thanks a lot for your PR! And congrats for your first contribution to OpenIddict! 🎉