enable code_challenge parameter

depends on cosmocode/dokuwiki-plugin-oauth#163

Author: xi

Keycloak.php

@@ -36,28 +36,28 @@ class Keycloak extends AbstractOAuth2Base
      *
      * @return string
      */
-    public function getEndpoint(string $endpoint)
+    public function getDiscovery(string $endpoint, $default = '')
     {
         if (!isset($this->discovery)) {
             $plugin = plugin_load('helper', 'oauthkeycloak');
             $json = file_get_contents($plugin->getConf('openidurl'));
             if (!$json) throw new \Exception('Failed accessing ' . $plugin->getConf('openidurl'));
             $this->discovery = json_decode($json, true);
         }
-        if (!isset($this->discovery[$endpoint])) return '';
+        if (!isset($this->discovery[$endpoint])) return $default;
         return $this->discovery[$endpoint];
     }
 
     /** @inheritdoc */
     public function getAuthorizationEndpoint()
     {
-        return new Uri($this->getEndpoint(self::ENDPOINT_AUTH));
+        return new Uri($this->getDiscovery(self::ENDPOINT_AUTH));
     }
 
     /** @inheritdoc */
     public function getAccessTokenEndpoint()
     {
-        return new Uri($this->getEndpoint(self::ENDPOINT_TOKEN));
+        return new Uri($this->getDiscovery(self::ENDPOINT_TOKEN));
     }
 
     /** @inheritdoc */
@@ -72,6 +72,18 @@ public function needsStateParameterInAuthUrl()
         return true;
     }
 
+    /** @inheritdoc */
+    public function getCodeChallengeMethod()
+    {
+        $methods = $this->getDiscovery('code_challenge_methods_supported', []);
+        foreach (['S256', 'plain'] as $m) {
+            if (in_array($m, $methods)) {
+                return $m;
+            }
+        }
+        return null;
+    }
+
     /**
      * Logout from Keycloak
      *
@@ -94,7 +106,7 @@ public function logout()
         ];
 
         $this->httpClient->retrieveResponse(
-            new Uri($this->getEndpoint(self::ENDPOINT_LOGOUT)),
+            new Uri($this->getDiscovery(self::ENDPOINT_LOGOUT)),
             $parameters,
             $this->getExtraOAuthHeaders()
         );