Generic OIDC flow with fief python client

[francbartoli]

Are generic OpenID Connect compliant identity providers like OpenAM supported by the fief client package? I have configured the FiefAsync class and followed the tutorial for FastAPI integration but I'm getting a NetworkError like in the picture when I land back

[frankie567]

Hello @francbartoli 👋

The Fief client is designed to work with Fief 🙃

I'm not sure to understand what you're trying to do here. I don't know OpenAM but it seems to be similar to Fief. Do you want to use Fief in conjunction with OpenAM?

[francbartoli]

Hi @frankie567, thanks for your response. I like fief with the decoupling of server/client and since OpenID Connect is a standard flow I expected to be working with different server implementations. I tried with OpenAM but Keycloak is another example.
Also, as far as I can see fief-client is likely the only one to support the PKCE mode within a FastAPI application and I need it for a project. I can work to see if this support might be widely available, is it of interest to you?

[frankie567]

Hmm, I see! Well there are two things here:

1. Regarding the OpenID/OAuth2 protocol, I think the client will work quite well for any compliant provider. If you give the right base URL, I think it'll be able to redirect to the authentication page and get a fresh token on callback without any issue.
2. However, concerning the authenticated dependency, I'm really not sure it'll work with other systems: it greatly depends how they implemented their access token.
   • In Fief, we just a JWT, meaning we can check its validity locally, without a roundtrip to the authentication server.
   • Besides , permissions are directly included in the data of the JWT, that's how we can check them directly.
   • If OpenAM, Keycloak or others don't do that, the authenticated dependency will reject the token.

For the basic OpenID protocol, I suggest you look at httpx-oauth, which is another of my project implementing the OAuth2 protocol for getting access token.