Proof of Concept: user authentication through OpenID Connect

[reinkrul]

This PoC verifies the feasibility of using the Nuts Node as OpenID Connect Provider to authenticate users from other care organizations. This can be used to log remote users into the organization's applications using generic OpenID Connect client libraries.

PoC setup can be found here: https://github.com/Zorgbijjou/nuts-openid-poc

Changes:

• Support /authorize with GET parameters (this disables the JAR requirement): client app might not be able to support JAR (e.g. MSAL.js)
  • Disabled aud claim verify if not set (need to solve this differently).
• Return id_token in access token when requested scope is openid
• Adds login_hint, which contains the authorization server URL at which to perform OpenID4VP. If not set, it falls back to using the clientID (party who started the flow).

TODO:

• Determine id_token claims from user auth
  • Implement OIDC user auth
• Determine whether Cookies not working on Safari and Firefox #3164 is a problem that needs to be addressed