diff --git a/CHANGELOG.md b/CHANGELOG.md index b7796f3..0ba047b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## Unreleased +- include ACR claim in ID token only if requested (#32) + ## [1.0.8] - 2025-09-10 - fix secrets submodule path following move to `proconnect-gouv` organization - update other references to `numerique-gouv` organization diff --git a/docker/oidc-test-client/app.py b/docker/oidc-test-client/app.py index 201a4db..d6ac74c 100644 --- a/docker/oidc-test-client/app.py +++ b/docker/oidc-test-client/app.py @@ -2,13 +2,10 @@ from flask import Flask, jsonify, request, session from oic.oic import Client from oic.utils.authn.client import CLIENT_AUTHN_METHOD from oic import rndstr -from oic.oic.message import RegistrationResponse +from oic.oic.message import Claims, ClaimsRequest, RegistrationResponse from oic.utils.http_util import Redirect from oic.oic.message import AuthorizationResponse import secrets -import webbrowser -import threading -import time import logging import os @@ -52,6 +49,7 @@ def index(): "nonce": session["nonce"], "redirect_uri": client.registration_response["redirect_uris"][0], "state": session["state"], + "claims": ClaimsRequest(id_token=Claims(acr=None, amr=None)), } ) login_url = auth_req.request(client.authorization_endpoint) diff --git a/src/satosa/plugins/frontends/openid_connect_frontend.yaml b/src/satosa/plugins/frontends/openid_connect_frontend.yaml index 8bf9d66..9505bad 100644 --- a/src/satosa/plugins/frontends/openid_connect_frontend.yaml +++ b/src/satosa/plugins/frontends/openid_connect_frontend.yaml @@ -56,8 +56,3 @@ config: - given_name usual_name: - usual_name - extra_id_token_claims: - oidc-test-client: - - acr - agent-connect: - - acr