Moving an OIDC client to PKCE

[Wessel, Keith]

Hi, all,

We have a mobile app that's been doing traditional token-based auth, and we're looking to move it to PKCE challenges using the least disruptive method possible. That is we'd ideally not have to change to a new client ID or invalidate any existing access or refresh tokens issued to users using the app. My initial plan was to just give the app a new client ID with forced PKCE enabled on it, but this would mean all users would need to sign in again when they run the new app for the first time.

When we first went down this road of PKCE with Shibboleth a few years ago, Henri said to enforce PKCE for a client, I would need to set tokenEndpointAuthMethods to none and forcePKCE to true, both best done with relying party overrides. As a transition, is there a way to allow a given client to use standard token-based auth _or_ PKCE? The idea would be to allow both methods, let the app developer push out a new version of the app that switches to PKCE, then after a sufficient amount of time for users to update to the new app version, begin forcing PKCE.

Is this possible? Or is there something better that I'm not thinking of here?

Thanks,
Keith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250213/9f8584b6/attachment.htm>