Dex: response_types_supported looks incorrect

[mkontani]

Thanks for useful tool. I want to confirm about response_types_supported.

For example, I think that if we set responseTypes '["code", "token"]' on configfile, '.well-known/openid-configuration's response_types_supported should be configured like '["code", "token", "code token"]', but current is configured like '["code", "token"]'.

In other ward, current is set response_types_supported only single type.
Is there any reason? Im sorry if it's my misunderstanding.

Thanks.

[srenatus]

You're probably correct. The spec isn't explicit here, I think:

response_types_supported
REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values.

...but in its example, it includes the concatenated strings like you suggested:
>

"response_types_supported":
  ["code", "code id_token", "id_token", "token id_token"],

Anyways, I think the openid-configuration output could be improved, see also #1209.

[mkontani]

@srenatus Thank you for confirmation!

In rfc6749, response_type can be set only one "code" or "token".
After OIDC defined, it became possible to set multiple response_type in any combination. (spec)

code token
When supplied as the value for the response_type parameter, a successful response MUST include an Access Token, an Access Token Type, and an Authorization Code. The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used. Both successful and error responses SHOULD be returned using the supplied Response Mode, or if none is supplied, using the default Response Mode.
code id_token
When supplied as the value for the response_type parameter, a successful response MUST include both an Authorization Code and an id_token. The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used. Both successful and error responses SHOULD be returned using the supplied Response Mode, or if none is supplied, using the default Response Mode.
id_token token
When supplied as the value for the response_type parameter, a successful response MUST include an Access Token, an Access Token Type, and an id_token. The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used. Both successful and error responses SHOULD be returned using the supplied Response Mode, or if none is supplied, using the default Response Mode.
code id_token token
When supplied as the value for the response_type parameter, a successful response MUST include an Authorization Code, an id_token, an Access Token, and an Access Token Type. The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used. Both successful and error responses SHOULD be returned using the supplied Response Mode, or if none is supplied, using the default Response Mode.

Now dex looks support multiple response_type in any combination.
https://github.com/dexidp/dex/blob/master/server/handlers.go#L565-L650