Oidc refresh

[nsklikas]

Fixes #751

This PR adds support for refreshing ID Tokens.

This PR breaks backwards compatibility with RefreshTokenGrant modifiers. If this is a problem, I could change the RefreshTokenGrant modifiers only for OIDC in order to remain backwards compatible.

[JonathanHuot]

Can you check & update the documentation generated for oidc please ?

tox -e docs

https://oauthlib.readthedocs.io/en/latest/oauth2/oidc.html#

[zzzevaka]

Hello! I am making the same functional in my own project and faced with a little problem.

An attribute request.client_id is used in add_id_token, but request.client_id is not set if using client_secret_basic authentication rather than client_secret_post.

I suggest to make modification in add_id_token in this PR:

- id_token['aud'] = request.client_id
+ id_token['aud'] = request.client_id or request.client.client_id

[nsklikas]

You are correct, this seems like a bug. But I don't think this is the right PR to fix this, unless @JonathanHuot thinks otherwise.

[nsklikas]

Any news on this?

[JonathanHuot]

Hi @zzzevaka , a new PR seems more appropriate for your fix.
@nsklikas , changes are required to support both oauth2 & OIDC provider ; can you have a look please ?
Thanks!

[nsklikas]

It's not clear to me what changes are required, can you please elaborate?

[JonathanHuot]

Depending the AS implementation, the id_token can be refreshed :

1. never
2. always
3. depending id_token parameter, like auth_time, or exp of id_token

I see that 1) and 2) can be implemented with the boolean, but not 3). I was wondering if it is possible to implement to support 3) as well.
Maybe if we add a RequestValidator method?
Any thoughts anyone ?

[nsklikas]

Yea, that makes sense. Moving it to the validator provides more flexibility.

I removed the class variable

[nsklikas]

I think it should be fine now.

[nsklikas]

Any changes needed?

[JonathanHuot]

LGTM Thanks for the feature!