NodeJS OIDC Provider getting aud and resource server errors upgrade from 6.x to 7.x

Question

I am trying to upgrade [node-oidc-provider] https://github.com/panva/node-oidc-provider from version 6.x to version 7.x. I am using the authorization code flow for a React application.

I am getting an error regarding aud (audience) being a required field for JWT tokens:

Error: JWT Access Tokens must contain an audience, for Access Tokens without audience (only usable at the userinfo_endpoint) use an opaque format

Looking at the code and documentation, I tried to update the aud field by defining a function in formats.jwt.customizers .

I am not sure if this is the right solution as after doing that, I faced an issue regarding invalid resource server configuration:

Error: invalid Resource Server jwt configuration

Below is my existing configuration (provided file is support/configuration.js):

module.exports = {
  clients: [
    {
        "application_type": "web",
        "grant_types": [
          "authorization_code"
        ],
        "id_token_signed_response_alg": "RS256",
        "post_logout_redirect_uris": [
          "http://localhost:3001"
        ],
        "require_auth_time": false,
        "response_types": [
          "code"
        ],
        "subject_type": "public",
        "token_endpoint_auth_method": "none",
        "introspection_endpoint_auth_method": "none",
        "revocation_endpoint_auth_method": "none",
        "request_uris": [],
        "client_id_issued_at": 1622600472.0,
        "client_id": "my_client_id",
        "client_name": "Sample client application",
        "client_secret_expires_at": 0.0,
        "client_secret": "my_client_secret" ,
        "redirect_uris": [
          "http://localhost:3001/callback"
        ],
        "client_background_uri": "/public/img/default.png",
        "app_id": "sample_app"
      }
  ],
  clientBasedCORS: (ctx, origin, client)=>{
    return true
  },
  interactions: {
    url(ctx, interaction) { // eslint-disable-line no-unused-vars
      return `/interaction/${interaction.uid}`;
    },
  },
  cookies: {
    keys: ['some secret key', 'and also the old rotated away some time ago', 'and one more'],
  },
  formats:{ 
    AccessToken :'jwt',
    customizers: { jwt: async(ctx, token, jwt)=>{
      jwt.payload.aud = jwt.payload.iss
    }}
  },
  claims: {
    address: ['address'],
    email: ['email', 'email_verified'],
    phone: ['phone_number', 'phone_number_verified'],
    profile: ['birthdate', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name',
      'nickname', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'],
  },
  features: {
    devInteractions: { enabled: false }, // defaults to true
    resourceIndicators: {
      enabled: true,
      async useGrantedResource(ctx) {
        return ctx.oidc.body && ctx.oidc.body.usegranted;
      },
      getResourceServerInfo(ctx, resource) {
        if (resource.includes('wl')) {
          return {
            audience: resource,
            scope: 'api:read api:write',
          };
        }

        throw new errors.InvalidTarget();
      },
      defaultResource(ctx) {
        if (ctx.oidc.body && ctx.oidc.body.nodefault) {
          return undefined;
        }

        return 'urn:wl:default';
      },
    },
    deviceFlow: { enabled: true }, // defaults to false
    revocation: { enabled: true }, // defaults to false
  },
  jwks: {
    keys: [/* keys left out for privacy*/]
  },
};

Answer 1

This is working with me using resourceIndicators configuration that looks like:

resourceIndicators: {
  enabled: true,
  getResourceServerInfo: async (ctx, resourceIndicator, client) => {
    return {
      scope: 'api:read api:write',
      audience: resourceIndicator,
      accessTokenTTL: 2 * 60 * 60, // 2 hours
      accessTokenFormat: 'jwt',
      jwt: {
        sign: { alg: 'RS256' },
      },
    }
  }