Allow disabling ID Token Validation

[carstenhag]

Feature Request

Add a boolean toggle to disable the ID token validation

Motivation

Should be optional, as some IDMs don't provide valid ID tokens. Also useful for local development. Should be added to restore old behavior of <0.8x versions.

Description

The ID token validation that was introduced in 0.8.0 is causing an issue when trying to login to the BMW Group IDM (GCDM). For other IDM providers it is working as expected. Seems like for GCDM there's no nonce. I will likely do some more research and find out whether this is a required or an optional field and contact them.

Up until then (and probably in other cases such as #585) we would want to disable this validation inside the appauth library. For us this is fine as there is an extra ID Token validation in our backend.

Here's the code that checks this specific nonce field:

// nonc=null, expectedNonce similar to "TCCE-wWads-dasda"
if (!TextUtils.equals(this.nonce, expectedNonce)) {
    throw AuthorizationException.fromTemplate(GeneralErrors.ID_TOKEN_VALIDATION_ERROR, new IdToken.IdTokenException("Nonce mismatch"));
}

Alternatives or Workarounds

The alternative would be to stay at 0.7.x or fork 0.8.0 and patch out the ID token check or the nonce validation.

Alternatively, for the nonce mismatch you can just set a specific nonce (null for example) to trick out the validation:

val builder = AuthorizationRequest.Builder(
            serviceConfiguration,
            mClientId,
            RESPONSE_TYPE,
            redirectUri
        )
builder.setNonce(null)

[carstenhag]

Just talked to my iOS colleagues (they use AppAuth iOS) and they have manually set the request nonce to nil, which is also basically disabling this specific check ;)

let request = OIDAuthorizationRequest(
    configuration: configuration,
    //... many more constructor parameters
    nonce: nil, // Nonce explicitly set to nil because some IDMs don't handle it correctly
)

Edit: Found the nonce workaround for Android, added it to the ticket:

val builder = AuthorizationRequest.Builder(
            serviceConfiguration,
            mClientId,
            RESPONSE_TYPE,
            redirectUri
        )
builder.setNonce(null)

[agologan]

@carstenhag how does this proposal #662 look to you?

[agologan]

Changes are now available in version 0.8.1 and there is a section on ID Token validation in the README.md

Thank you for your contribution.