Add OAuth2 provider configs for Ory, Okta, Discord, Twitch and Spotify - #760
Open
jnbdz wants to merge 7 commits into
Open
Add OAuth2 provider configs for Ory, Okta, Discord, Twitch and Spotify#760jnbdz wants to merge 7 commits into
jnbdz wants to merge 7 commits into
Conversation
Simplified factory for Ory Network / self hosted Ory Hydra with the public OAuth2/OIDC endpoints documented in the Ory Hydra API reference, plus an OpenID Connect discovery shortcut. Fixes eclipse-vertx#377
Supports both the org authorization server and custom authorization servers (e.g. "default"), with endpoints from the Okta OIDC API reference. See eclipse-vertx#419
Twitch expects the client credentials in the token request body, so basic authorization is disabled for this provider. See eclipse-vertx#419
ProviderConfigTest asserts, without network access, that each new provider shortcut configures the endpoints documented by the provider. The docs list the new providers and the OIDC discovery URLs for Okta, Ory and Twitch.
Add discovery-contract tests to OpenIDCDiscoveryTest, next to the existing live tests for Google, Microsoft, Salesforce, IBM and Apple: the endpoints advertised in the provider's OpenID Connect discovery document must match the endpoints hardcoded by TwitchAuth.create() and OktaAuth.create() (org and custom authorization server variants), so future endpoint drift is caught by CI. Endpoints omitted from the discovery document (Twitch does not advertise its documented revocation endpoint) are not compared. Ory Network is not reachable from non-browser clients and Discord/Spotify publish no discovery document, so those providers stay covered by ProviderConfigTest only.
pmlopes
approved these changes
Aug 17, 2026
Member
Member
|
Can you please take a look at the failures? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #377
Refs #419
Adds five provider shortcuts to
vertx-auth-oauth2, one commit per provider so any of them can be dropped independently:OryAuthcreate(vertx, site, clientId, clientSecret)+discover(...); closes #377OktaAuthcreate(vertx, clientId, clientSecret, domain)) and custom authorization server (..., domain, authorizationServerId) +discover(...)DiscordAuthTwitchAuthdiscover(...); Twitch only accepts client credentials in the token request body souseBasicAuthorizationis disabledSpotifyAuthPer the acceptance criteria in #419, every endpoint carries a code comment / javadoc link to the official provider documentation it was taken from, and each javadoc documents the
userInfoendpoint and the fields/claims it returns (and which scopes gate them).ProviderConfigTestverifies, without network access, that each shortcut produces the documentedOAuth2Options. On top of that,OpenIDCDiscoveryTestgained live discovery-contract tests (next to the existing Google/Microsoft/Salesforce/IBM/Apple ones) asserting that the endpoints advertised by the Twitch and Okta (org + custom authorization server) discovery documents match whatcreate()hardcodes, so endpoint drift is caught by CI. Ory Network blocks non-browser clients and Discord/Spotify publish no discovery document, so those stay covered byProviderConfigTestonly. The docs list the new providers and add the OIDC discovery URLs for Okta, Ory and Twitch.Left out of this PR from the #419 list: Apple, Auth0 and GitLab already exist; IdentityServer4 is discontinued; Atlassian, Battle.net and Yandex can follow in a later PR if wanted.