feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers #271

wizzfi1 · 2025-10-17T12:24:06Z

Summary

This PR fixes an inconsistency in how the JS SDK constructs the OIDC token endpoint URL.

Updated the URL construction logic to correctly handle custom token paths (e.g./oauth/v2/token).
Brought JS SDK behavior in line with Go and Java SDKs.
Added/verified relevant tests to ensure backward compatibility.

Motivation

Addresses #141
(Inconsistency in OIDC token path construction between SDKs and incompatibility with custom token paths)

Notes

Verified all tests pass locally (npm test ✅).
Confirmed correct URL formation for both default and custom OIDC paths.
Happy to adjust based on feedback!

Summary by CodeRabbit

Style
- Minor code formatting adjustments in test files for improved consistency.

Note: No end-user visible changes in this release.

coderabbitai · 2025-10-17T12:24:32Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

The pull request adds blank lines around the testConfig declaration in the test file, making a purely cosmetic formatting adjustment with no functional impact.

Changes

Cohort / File(s)	Summary
Whitespace formatting `tests/headers.test.ts`	Added two blank lines around testConfig declaration for improved code spacing

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minute

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.
Title Check	✅ Passed	The PR title "feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers" is specific, clear, and directly aligned with the stated PR objectives. The title accurately describes the main feature being implemented—handling custom OIDC token endpoint paths across multiple providers. It follows conventional commit format and is concise without being vague. The title is neither misleading nor off-topic; it clearly communicates the primary change from the developer's perspective.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

wizzfi1 · 2025-10-17T12:25:25Z

Thanks for reviewing!
I verified that all tests now pass and that the token path behavior matches other SDKs.
Happy to update anything if needed.

rhamzeh · 2025-10-17T14:56:32Z

Thanks for the PR @wizzfi1

Some issues:

The title and the contents of the PR do not match
Please add tests to cover these use-cases: [All SDKs] OAuth token endpoint should be configurable and/or support oidc discovery sdk-generator#238 - feel free to look at how it was done in other SDKs
Please update the README and Changelog with your changes

wizzfi1 · 2025-10-17T19:42:34Z

Thanks for the PR @wizzfi1

Some issues:

The title and the contents of the PR do not match

Please add tests to cover these use-cases: [All SDKs] OAuth token endpoint should be configurable and/or support oidc discovery sdk-generator#238 - feel free to look at how it was done in other SDKs

Please update the README and Changelog with your changes

Thanks for the feedback! I've addressed all the issues:

✅ Fixed PR title/content mismatch - focused solely on OIDC token path functionality

✅ Added comprehensive tests - 7 test cases covering all OIDC scenarios from #238

✅ Updated README and CHANGELOG - added documentation for the new feature

The OIDC token path handling is now consistent with other SDKs and supports custom paths for providers like Zitadel and Entra ID."

… and other providers - Normalize OIDC token URL construction to handle custom paths - Respect existing paths when provided (e.g., /oauth/v2/token) - Only append /oauth/token when no path is specified - Add proper URL parsing and validation for both domain-only and full URL issuers - Fix telemetry configuration issues - Fix client assertion audience for full URL issuers - Add comprehensive tests covering Zitadel, Entra ID, and custom path scenarios - Update README with OIDC configuration examples - Update CHANGELOG with new feature Fixes openfga#141 References openfga#238

jimmyjames

Thanks for addressing those things @wizzfi1! 🙏

If you don't mind, I left some additional feedback if you are willing to address. Also, if using AI to assist, please take a pass through as sometimes it will add superfluous and process-related comments, and many of them aren't valuable to keep in the codebase.

Thanks!

jimmyjames · 2025-10-20T21:09:19Z

CHANGELOG.md

 ## [Unreleased](https://github.com/openfga/js-sdk/compare/v0.9.0...HEAD)

+### Added
+- Support for custom OIDC token endpoint paths (#141, #238)


I think you meant to reference openfga/sdk-generator#238?

jimmyjames · 2025-10-20T21:14:42Z

CHANGELOG.md

+- Compatibility with Zitadel, Entra ID, and other OIDC providers using non-standard token paths
+
+### Fixed
+- OIDC token URL construction to handle custom paths consistently with other SDKs


Is the "fixed" line entry this different than #141 referenced above? I think just having an "added" entry as you do above should suffice.

jimmyjames · 2025-10-21T17:01:53Z

credentials/credentials.ts

          userAgent: this.baseOptions?.headers["User-Agent"],
          fgaMethod: "TokenExchange",
-          url,
+          url: tokenUrl, // FIXED: Use tokenUrl instead of undefined 'url'


This comment doesn't seem necessary, would you mind removing it?

jimmyjames · 2025-10-21T17:03:26Z

credentials/credentials.ts

+      //Fixed audience: Handle both full URLs and domain-only issuers
+      const audienceIssuer = config.apiTokenIssuer.startsWith("http://") || config.apiTokenIssuer.startsWith("https://")
+        ? config.apiTokenIssuer
+        : `https://${config.apiTokenIssuer}`;


it looks like we have the same logic to check the scheme and prepend https:// if needed a few places here? Let's move that logic to its own internal function to not repeat if possible.

jimmyjames · 2025-10-21T19:45:51Z

README.md

 });
 ```

+### OIDC Token Endpoint Configuration


I don't think a new section is needed for this info; it can be included in the "Client Credentials" subsection above. I think it can be a more concise non-vendor specific mention about the behavior and how a full path can be set and it will be respected.

jimmyjames · 2025-10-21T19:46:37Z

README.md

+This ensures compatibility with OIDC providers that use non-standard token endpoint paths.
+
+```
+## 3. Create the OIDC Test File


We don't need to include this info or example tests in the README.

Updated the changelog to reflect new features and changes.

Removed OIDC Token Endpoint Configuration section and related details from README.

Refactored API token issuer normalization into a reusable function for improved code clarity and maintainability.

wizzfi1 · 2025-10-21T22:52:19Z

Thank you very much for your review! @jimmyjames

I have implemented the changes. Please go through as I await your kind feedback. Thank you!

jimmyjames · 2025-10-22T21:21:36Z

CHANGELOG.md



-## [Unreleased](https://github.com/openfga/js-sdk/compare/v0.9.0...HEAD)
+## [Unreleased](https://github.com/openfga/sdk-generator#238)


This shouldn't be changed, it would now link out to an issue in the generator repo. My comment below about referencing #238 from the generator repo was intended for that line, not here.

jimmyjames · 2025-10-22T21:22:56Z

README.md

 });
 ```

+#### Default Behavior


The information here is very specific to the token endpoint handling for the client credentials grant. Having a separate section would be a bit confusing it should be info within the client credentials section.

jimmyjames · 2025-10-22T21:24:27Z

README.md

+  - `auth.example.com/oauth/v2` → `https://auth.example.com/oauth/v2`
+  - `https://auth.example.com/oauth/v2/token` → `https://auth.example.com/oauth/v2/token`
+
+#### Provider Examples


We don't need to have specific vendor examples, general behavior documentation will be good. Also a full test file is not necessary just the token domain/path handling will suffice.

test(headers): allow local HTTPS domain in Nock setup

0077d28

wizzfi1 requested a review from a team as a code owner October 17, 2025 12:24

wizzfi1 changed the title ~~fix: make OIDC token path handling consistent with other SDKs~~ test: update Nock configuration for local HTTPS domains in headers tests Oct 17, 2025

wizzfi1 force-pushed the fix/headers-merge-behavior branch 2 times, most recently from 2e0c5ca to 466fb81 Compare October 17, 2025 19:24

wizzfi1 requested review from a team as code owners October 17, 2025 19:24

wizzfi1 force-pushed the fix/headers-merge-behavior branch from 466fb81 to e98670f Compare October 17, 2025 19:28

feat: support custom OIDC token endpoint paths

02c8184

wizzfi1 force-pushed the fix/headers-merge-behavior branch from e98670f to 02c8184 Compare October 17, 2025 19:39

wizzfi1 changed the title ~~test: update Nock configuration for local HTTPS domains in headers tests~~ fix: make OIDC token path handling consistent with other SDKs Oct 17, 2025

wizzfi1 changed the title ~~fix: make OIDC token path handling consistent with other SDKs~~ "feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers" Oct 17, 2025

wizzfi1 changed the title ~~"feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers"~~ feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers Oct 17, 2025

jimmyjames requested changes Oct 21, 2025

View reviewed changes

wizzfi1 added 3 commits October 21, 2025 23:35

Revise CHANGELOG for new OIDC support and fixes

bd647cc

Updated the changelog to reflect new features and changes.

Remove OIDC Token Endpoint Configuration details

4004b97

Removed OIDC Token Endpoint Configuration section and related details from README.

Refactor API token issuer normalization logic

d735172

Refactored API token issuer normalization into a reusable function for improved code clarity and maintainability.

jimmyjames requested changes Oct 22, 2025

View reviewed changes



		## [Unreleased](https://github.com/openfga/js-sdk/compare/v0.9.0...HEAD)
		## [Unreleased](https://github.com/openfga/sdk-generator#238)

feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers #271

Are you sure you want to change the base?

feat: support custom OIDC token endpoint paths for Zitadel, Entra ID, and other providers #271

Conversation

wizzfi1 commented Oct 17, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Notes

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

wizzfi1 commented Oct 17, 2025

Uh oh!

rhamzeh commented Oct 17, 2025

Uh oh!

wizzfi1 commented Oct 17, 2025

Uh oh!

jimmyjames left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wizzfi1 commented Oct 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wizzfi1 commented Oct 17, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Oct 17, 2025 •

edited

Loading