feat: Add resource parameter to the OAuth2 token request to follow RFC-8707

[scandinave]

What this PR changes/adds

This PR makes the OAuth2 implementation ask for a token with a resource from param to follow the RFC-8707.

Why it does that

This allows an IDP to set the correct aud claim in the access token given to the connector.

Further notes

Linked Issue(s)

Closes #4668

[jimmarino]

PRs need to be accompanied by tests. Please create unit tests that cover the changes.

[scandinave]

I've updated tests to validate the new parameter.

[jimmarino]

This can change existing behavior in some cases. If the resource is not set as a param, it should not be set on the client OAuth request.

Also, this should be an opt-in configuration parameter that is off by default (please document with @Setting). This behavior also needs to be tested.

[scandinave]

I was thinking that the resource will always be set because there is always a counterPartyAddress right? Connector validates the audience of the access token when receiving request. If no resource is set, the audience will not match.

But I can definitely make a configurable option to enable this on demands for people that don't care about that.

I will rework my PR.

[jimmarino]

I was thinking that the resource will always be set because there is always a counterPartyAddress right? Connector validates the audience of the access token when receiving request. If no resource is set, the audience will not match.

But I can definitely make a configurable option to enable this on demands for people that don't care about that.

I will rework my PR.

Yes, please do to preserve the existing behavior.

[scandinave]

I've had a test in the Daps extension that highlight the current situation. It is called Rfc8707IntegrationTest. With this PR, if we have the DAPS extension that tells the IDP to set a specific audience and we also enabled the new resource parameter feature, the audience will have the value sent via the resource parameter.

What behavior do you expect for this ? :

• Let the IDP implementation choose the value that it takes into account (this is the behavior with the current PR state.)
• Make the Daps override the resource parameter
• Make the Daps throw a warning/error telling why it can't due its job.