refactor: move iss param handling to Fosite

backend/internal/oidc/authorization_handler.go

@@ -21,18 +21,15 @@ const parRequestURIPrefix = "urn:ietf:params:oauth:request_uri:"
 type authorizationHandler struct {
 	provider             fosite.OAuth2Provider
 	authorizationService *authorizationService
-	baseURL              string
 }
 
 func newAuthorizationHandler(
 	provider fosite.OAuth2Provider,
 	authorizationService *authorizationService,
-	baseURL string,
 ) *authorizationHandler {
 	return &authorizationHandler{
 		provider:             provider,
 		authorizationService: authorizationService,
-		baseURL:              baseURL,
 	}
 }
 
@@ -99,8 +96,6 @@ func (h *authorizationHandler) authorize(c *gin.Context) {
 		return
 	}
 
-	response.AddParameter("iss", h.baseURL)
-
 	// fosite renders an auto-submitting HTML page for response_mode=form_post, which needs a relaxed CSP
 	h.relaxCSPForFormPost(c, ar)
 

backend/internal/oidc/module.go

@@ -101,7 +101,7 @@ func New(ctx context.Context, deps Dependencies) (*Module, error) {
 		store:        store,
 		cimdResolver: cimdResolver,
 
-		authorizationHandler: newAuthorizationHandler(provider, authorizationService, deps.Config.BaseURL),
+		authorizationHandler: newAuthorizationHandler(provider, authorizationService),
 		tokenHandler:         newTokenHandler(provider, claimsService, deps.APIAccess),
 		userInfoHandler:      newUserInfoHandler(provider, claimsService, deps.Config.BaseURL),
 		parHandler:           newPARHandler(provider),

backend/internal/oidc/provider.go

@@ -43,6 +43,7 @@ func newProvider(store *Store, authenticator *federatedClientAuthenticator, sign
 		PushedAuthorizeContextLifespan:          90 * time.Second,
 		IDTokenIssuer:                           config.BaseURL,
 		AccessTokenIssuer:                       config.BaseURL,
+		AuthorizationResponseIssuer:             config.BaseURL,
 		TokenURL:                                config.TokenBaseURL + "/api/oidc/token",
 		ScopeStrategy:                           fosite.ExactScopeStrategy,
 		IgnoreUnknownScopes:                     true,