Hub OIDC Authorization code flow

[zdenek.kabatek]

Hi,

currently, Hub supports OIDC authentication, however, it supports only deprecated approach via "implicit flow". Client suggests to implement newer "Authorization code flow" which is safer from security perspective.

Regards

Zdenek

[Begusseau_S]

blocker for us too. Our corporate IdP only accepts the Authorization Code Flow, so Hub 5.2's implicit flow (response_type=id_token) is rejected with insupported_response_type.
The implicit flow is also deprecated ans not allowed in production by our security policy. Configurable response type ans scopes per OIDC provider would solve it. Any roadmap info welcome.