- Notifications
You must be signed in to change notification settings - Fork1.1k
feat: implement OAuth2 dynamic client registration (RFC 7591/7592)#18645
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
ThomasK33 commentedJun 27, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
3902793 tob37d850Compareff83df4 to3665807Compareb37d850 tocaf974cCompare3665807 to56126ddComparecaf974c to22b8b6dCompare56126dd tofca6b9aCompare14c7196 toc43b551Comparefca6b9a to68baa21Compare46d50e8 to61142baComparea8a29d4 tof9e693dCompareThomasK33 commentedJul 2, 2025
Looking at the router/ Are you suggesting moving those handlers into a different package or moving the logic behind them into their own package, which then gets called from those API handlers? (I'm assuming the latter, but I want to be sure.) |
3760dd0 to2a41a65Compare9629df1 todf790c7Compare52c88e0 to4799b4bComparedf790c7 to17af791Comparea07ba99 to5c1b9f6Compare17af791 to3e15358Compare3e15358 to6bea7a6Compare6bea7a6 toe33d3d6Compare… MCP compliance- Add comprehensive OAuth2 dynamic client registration support- Implement RFC 7591 client registration endpoint with proper validation- Implement RFC 7592 client management protocol (GET/PUT/DELETE)- Add RFC 6750 Bearer token authentication support- Fix authorization context issues with AsSystemRestricted- Add proper RBAC permissions for OAuth2 resources- Implement registration access token security per RFC 7592- Add comprehensive validation for redirect URIs, grant types, response types- Support custom schemes for native applications- Add database migration with all RFC-required fields- Add audit logging support for OAuth2 operations- Ensure full RFC compliance with proper error handling- Add comprehensive test coverage for all scenariosChange-Id: I36c711201d598a117f6bfc381fc74e07fc3cc365Signed-off-by: Thomas Kosiewski <tk@coder.com>
e33d3d6 to4f4e4f1CompareThomasK33 commentedJul 3, 2025
Alright, so I did the refactoring in two PRs:
The main reason for this two PR approach was to make sure that the refactorings didn't break the tests, and that the test refactoring did not break the code. |
johnstcn left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I don't have any further blocking comments, but would appreciate a second pair of eyes before merge in case I missed something.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
nit: the validation tests could probably live in codersdk alongside the func itself but open to it staying here either
74e1d5c intomainUh oh!
There was an error while loading.Please reload this page.
ThomasK33 commentedJul 3, 2025
Merge activity
|

Implement OAuth2 Dynamic Client Registration (RFC 7591/7592)
This PR implements OAuth2 Dynamic Client Registration according to RFC 7591 and Client Configuration Management according to RFC 7592. These standards allow OAuth2 clients to register themselves programmatically with Coder as an authorization server.
Key changes include:
Added database schema extensions to support RFC 7591/7592 fields in the
oauth2_provider_appstableImplemented
/oauth2/registerendpoint for dynamic client registration (RFC 7591)Added client configuration management endpoints (RFC 7592):
/oauth2/clients/{client_id}Added comprehensive validation for OAuth2 client metadata:
Enhanced developer documentation with:
The implementation follows security best practices from the RFCs, including proper token handling, secure defaults, and appropriate error responses. This enables third-party applications to integrate with Coder's OAuth2 provider capabilities programmatically.