feat: set aud claim to Issuer for FAPI2 profiles

[paulswartz]

At some point, this became part of the spec:

https://openid.bitbucket.io/fapi/fapi-security-profile-2_0.html#section-5.3.1

Authorization servers [...] shall only accept its issuer identifier value (as defined in [RFC8414]) as a string in the aud claim received in client authentication assertions;

We add a parameter to control this, and set it as a part of the FAPI2 profiles.

• I'm not wedded to the name of the option if others have a better idea.
• Maybe this is a fix not a feat?

[coveralls]

Pull Request Test Coverage Report for Build 247

Details

• 4 of 5 (80.0%) changed or added relevant lines in 2 files are covered.
• 1 unchanged line in 1 file lost coverage.
• Overall coverage decreased (-0.1%) to 91.823%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/oidcc_auth_util.erl	3	4	75.0%

Files with Coverage Reduction	New Missed Lines	%
src/oidcc_provider_configuration_worker.erl	1	95.35%

Totals
Change from base Build 228:	-0.1%
Covered Lines:	1078
Relevant Lines:	1174

---

💛 - Coveralls

[maennchen]

Thanks @paulswartz.

I don't have a better idea right now about the name. Is there something similar in other implementations that we could copy? (For example the node oidc client)

I don't care much about feat / fix since we're not using conventional commits at the moment. If you feel like we should, we can discuss that separately.

[paulswartz]

Good idea: I'll check to see how node-oidc handles this.

[paulswartz]

@maennchen oidc-client always uses the issuer as the “aud” claim (panva/openid-client@0b05217) but allows clients to override the claims.

FWIW changing oidcc to always use the issuer passes both the OIDC and FAPI2 conformance suites, as well as rebar3 ct.

[maennchen]

@paulswartz That sounds like a good idea. If it passes all tests and can be overridden, I'm happy with that solution.