Support for Demonstrating Proof of Possession (DPoP) in quarkus-oidc

[sberyozkin]

Description

https://datatracker.ietf.org/doc/html/rfc9449 is about proving that a bearer token was indeed issued to the client which is presenting it.

It also provides an authorization code flow binding to DPoP: https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-code-binding-, tightening the security of the code flow process.

Implementation ideas

No response

[quarkus-bot]

/cc @pedroigor (oidc)

[jeremy-nocek-rp]

This would benefit my product, we're getting requests to add DPoP support.

[sberyozkin]

@jeremy-nocek-rp Sure, it is on the map for early 2025.

[sberyozkin]

@jeremy-nocek-rp FYI, #45891

[jeremy-nocek-rp]

@jeremy-nocek-rp FYI, #45891

Thanks for the heads up 😃

[sberyozkin]

@jeremy-nocek-rp Np, it will also be evolved, most likely we'll follow up with accepting custom DPoP challenge nonce providers as well, etc