[oidc-middleware] Add oidcClientOptions

packages/oidc-middleware/README.md

@@ -170,6 +170,7 @@ Optional config:
 * **routes** - Allows customization of the generated routes. See [Customizing Routes](#customizing-routes) for details.
 * **maxClockSkew** - Defaults to 120. This is the maximum difference allowed between your server's clock and Okta's in seconds. Setting this to 0 is not recommended, because it increases the likelihood that valid jwts will fail verification due to `nbf` and `exp` issues.
 * **timeout** - Defaults to 10000 milliseconds. The HTTP max timeout for any requests to the issuer.  If a timeout exception occurs you can catch it with the `oidc.on('error', fn)` handler.
+* **oidcClientOptions** - Optional metadata passed to [OpenId Client constructor](https://github.com/panva/node-openid-client/blob/main/docs/README.md#new-clientmetadata-jwks-options). For example, you can override `token_endpoint_auth_method` to one of supported [client authentication methods](https://github.com/panva/node-openid-client/blob/main/docs/README.md#client-authentication-methods) eg. `client_secret_post` (default is `client_secret_basic`)
 
 #### oidc.router
 

packages/oidc-middleware/src/ExpressOIDC.js

@@ -52,6 +52,7 @@ module.exports = class ExpressOIDC extends EventEmitter {
    * @param {string} [options.routes.loginCallback.path=/authorization-code] Path where the callback middleware is hosted
    * @param {string} [options.routes.loginCallback.afterCallback=/] Where to redirect once callback is complete
    * @param {Function} [options.routes.loginCallback.handler] This handles responses from the OpenId Connect callback
+   * @param {Object} options.oidcClientOptions Custom options passed to OpenId Client
    */
   constructor(options = {}) {
     super();

packages/oidc-middleware/src/oidcUtil.js

@@ -54,7 +54,8 @@ oidcUtil.createClient = context => {
     client_secret,
     loginRedirectUri: redirect_uri,
     maxClockSkew,
-    timeout
+    timeout,
+    oidcClientOptions
   } = context.options;
 
   Issuer[custom.http_options] = function(options) {
@@ -65,13 +66,13 @@ oidcUtil.createClient = context => {
 
   return Issuer.discover(issuer +  '/.well-known/openid-configuration')
   .then(iss => {
-    const client = new iss.Client({
+    const client = new iss.Client(Object.assign({
       client_id,
       client_secret,
       redirect_uris: [
         redirect_uri
       ]
-    });
+    }, oidcClientOptions));
     client[custom.http_options] = options => {
       options = customizeUserAgent(options);
       options.timeout = timeout || 10000;

packages/oidc-middleware/test/unit/constructor.spec.js

@@ -1,4 +1,5 @@
 const OpenIdClient = require('openid-client');
+const passport = require('passport');
 const nock = require('nock');
 const os = require('os');
 const path = require('path');
@@ -284,5 +285,23 @@ describe('new ExpressOIDC()', () => {
         done();
       })
     });
-  })
+  });
+
+  it('should set token_endpoint_auth_method', (done) => {
+    mockWellKnown();
+    const passportStrategySetter = jest.spyOn(passport, 'use').mockImplementation(() => {});
+
+    new ExpressOIDC({
+      ...minimumConfig,
+      oidcClientOptions: {
+        token_endpoint_auth_method: 'client_secret_post',
+      }
+    })
+    .on('ready', () => {
+      const passportStrategy = passportStrategySetter.mock.calls[0][1];
+      const oidcClient = passportStrategy._client;
+      expect(oidcClient.token_endpoint_auth_method).toBe('client_secret_post');
+      done();
+    });
+  });
 });