PKCE Fields not contained within Generic OIDC connector forwarded request towards external IdP

❌Unsolved🪲Bugs

After setting up a Generic OIDC connector, I expect the PKCE fields ( code_challenge, code_challenge_method) to be sent towards my external system.

These are not contained in the sent request to the external system.

This is my setup in Zitadel test cloud (see image).

This is my sent call towards the Zitadel connector:

https://<my-cloud-instance>.cloud/oauth/v2/authorize
  ?client_id=<your_oidc_client_id>
  &redirect_uri=<your_redirect_uri>
  &response_type=code
  &scope=openid%20profile%20email
  &code_challenge=<generated_code_challenge>
  &code_challenge_method=S256
  &state=<random_state>
  &nonce=<random_nonce>
  &idp_hint=<your_zitadel_oidc_idp_id>

https://<my-cloud-instance>.cloud/oauth/v2/authorize
  ?client_id=<your_oidc_client_id>
  &redirect_uri=<your_redirect_uri>
  &response_type=code
  &scope=openid%20profile%20email
  &code_challenge=<generated_code_challenge>
  &code_challenge_method=S256
  &state=<random_state>
  &nonce=<random_nonce>
  &idp_hint=<your_zitadel_oidc_idp_id>

Is there something I'm doing incorrectly or is this an actual bug?
Is there a problem with the test cloud instance?

Relevant fields as indicated by Read Me:

Environment: Zitadel Cloud (Test Instance)
Version: Not available to check on Cloud Test instance
Stack: C# .NET
What you expected to happen: Zitadel to forward my request to the external identity provider according to my settings (including PKCE)
What went wrong: Forwarded request does not containt PKCE required fields(code_challenge and code_challenge_method)

PKCE Fields not contained within Generic OIDC connector forwarded request towards external IdP

❌Unsolved🪲Bugs

https://<my-cloud-instance>.cloud/oauth/v2/authorize
  ?client_id=<your_oidc_client_id>
  &redirect_uri=<your_redirect_uri>
  &response_type=code
  &scope=openid%20profile%20email
  &code_challenge=<generated_code_challenge>
  &code_challenge_method=S256
  &state=<random_state>
  &nonce=<random_nonce>
  &idp_hint=<your_zitadel_oidc_idp_id>

https://<my-cloud-instance>.cloud/oauth/v2/authorize
  ?client_id=<your_oidc_client_id>
  &redirect_uri=<your_redirect_uri>
  &response_type=code
  &scope=openid%20profile%20email
  &code_challenge=<generated_code_challenge>
  &code_challenge_method=S256
  &state=<random_state>
  &nonce=<random_nonce>
  &idp_hint=<your_zitadel_oidc_idp_id>

PKCE Fields not contained within Generic OIDC connector forwarded request towards external IdP

PKCE Fields not contained within Generic OIDC connector forwarded request towards external IdP

Continue the conversation

ZITADEL

Continue the conversation

ZITADEL

Similar Threads