Redirect_uri in dynamically registered OIDC client can't be localhost

[Henri Mikkonen]

> On 18. Feb 2022, at 5.45, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> We discovered this a while back, but we've ignored it, and I'm wondering if it was an intentional choice or just a side effect of URL sanity checking. At least since V3.0, and maybe before, the IdP refuses to accept a dynamically registered OIDC client that has localhost as a hostname. I don't think it's localhost that it specifically disapproves of; I think it's the lack of a dot. Localhost.localdomain, for instance, works if it's in the hostname part of the URL.

We’ve followed the rules for the metadata values as specified by the OIDC dynamic client registration spec [1]. See the section 2 (Client metadata) and ‘application_type’.

If the application_type is undefined or ‘web’  (default), localhost as the hostname is not accepted. The hostnames may contain localhost as substring though.

[1] https://openid.net/specs/openid-connect-registration-1_0.html

> This used to work in earlier versions of the OIDC extension. It definitely worked back in the days of 1.X.

Umm, the code regarding this feature hasn’t changed in ages. Are you sure that the registartion request message has been similar for 1.X, or did it for instance contain application_type=native?

> Is this intentional? And, if so, is there some undocumented property or parameter to allow it?

There’s no properties for managing this at the moment.

BR,
Henri.