fosite custom auth request validator?

[anderspitman]

I'm trying to implement a simple OIDC server that uses the "registration-free" OAuth2 setup described here:

https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

Essentially instead of needing to register a client with the OP ahead of time, the OP simply verifies at auth request time that the redirect URL is on the same domain as the client_id (which is simply the URL where the client app is hosted).

I'm trying to determine if this can be implemented with fosite. After some poking through the code, fosite appears to be hard-coded to only allow pre-registered clients, which must be in the store at the time the auth request is received, as seen here:

https://github.com/ory/fosite/blob/45a6785cc54fcbd9195b0de4b821bb5fed6a41be/authorize_request_handler.go#L167

Am I missing something? Is there a way to do this with fosite?

[vinckr]

Hello @anderspitman

Seeing as the setup described is a bit older and the listed implementations as well - do you know of any "bigger" project that has implemented this?

I guess it is not really related to Dynamic Client Registration , right?