From cb932adbb2276e77db73874aa77e37a86c96596d Mon Sep 17 00:00:00 2001
From: Danny Bessems <djpbessems@[...]>
Date: Tue, 31 Oct 2023 13:18:01 +0000
Subject: [PATCH] Update 'internal/federationdomain/oidc/oidc.go'

---
 internal/federationdomain/oidc/oidc.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/internal/federationdomain/oidc/oidc.go b/internal/federationdomain/oidc/oidc.go
index 2f5c8941..e85b70d6 100644
--- a/internal/federationdomain/oidc/oidc.go
+++ b/internal/federationdomain/oidc/oidc.go
@@ -144,7 +144,10 @@ func FositeOauth2Helper(
 		RefreshTokenLifespan:  timeoutsConfiguration.RefreshTokenLifespan,
 
 		ScopeStrategy: fosite.ExactScopeStrategy,
-		EnforcePKCE:   true,
+		// The only public client is pinniped-cli, so this combination of PKCE settings requires PKCE for the
+		// pinniped-cli client and does not require PKCE for any dynamically configured OIDCClients.
+		EnforcePKCE:                 false,
+		EnforcePKCEForPublicClients: true,
 
 		// "offline_access" as per https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
 		RefreshTokenScopes: []string{oidcapi.ScopeOfflineAccess},