Yes, r3 only acts as an OpenID client. Though the auth code provided by the OpenID identity provider is not the same as a r3 access token. Once redirected to r3, after authentication via OpenID, the code is used to retrieve an access token for access to r3 resources.
See login.js:
// check for Open ID authentication redirect
const params = new URLSearchParams(window.location.search);
if(params.has('state') && params.has('code')) {
// attempt Open ID authentication against r3 backend, if local state matches
if(this.openIdAuthDetails.state === atob(params.get('state'))) {
this.authenticateByOpenId(
this.openIdAuthDetails.oauthClientId,
params.get('code'),
this.openIdAuthDetails.codeVerifier
);
}
// ...
}
The authentication via OpenID code still occurs via websocket request from the r3 frontend:
authenticateByOpenId(oauthClientId,code,codeVerifier) {
ws.send('auth','openId',{
code:code,
codeVerifier:codeVerifier,
oauthClientId:oauthClientId
},true).then(
res => {
// ...
},
err => this.handleError('authUser',err)
);
// ...
}
The code must be validated by the r3 backend to finish the OAuth2.0 flow 'Authorization Code Flow with Proof Key for Code Exchange'.
So if your plan is to get access tokens for an API user via OpenID authentication, we are missing a component: The option to execute a REST authentication call via OpenID code.
If you want to test OAuth features, just drop me your current contact via our contact form and I´ll prepare a dev license for your.
