Auto-detection

src/pretix/base/customersso/oidc.py

@@ -163,7 +163,7 @@ def oidc_authorize_url(provider, state, redirect_uri, pkce_code_verifier):
     if "query_parameters" in provider.configuration and provider.configuration["query_parameters"]:
         params.update(parse_qsl(provider.configuration["query_parameters"]))
 
-    if pkce_code_verifier:
+    if pkce_code_verifier and "S256" in provider.configuration['provider_config'].get('code_challenge_methods_supported', []):
         params["code_challenge"] = base64.urlsafe_b64encode(hashlib.sha256(pkce_code_verifier.encode()).digest()).decode().rstrip("=")
         params["code_challenge_method"] = "S256"
 
@@ -192,7 +192,7 @@ def oidc_validate_authorization(provider, code, redirect_uri, pkce_code_verifier
         'redirect_uri': redirect_uri,
     }
 
-    if pkce_code_verifier:
+    if pkce_code_verifier and "S256" in provider.configuration['provider_config'].get('code_challenge_methods_supported', []):
         params["code_verifier"] = pkce_code_verifier
 
     if token_endpoint_auth_method == 'client_secret_post':

src/pretix/presale/views/oidc_op.py

@@ -542,6 +542,7 @@ class ConfigurationView(View):
             'token_endpoint_auth_methods_supported': [
                 'client_secret_post', 'client_secret_basic'
             ],
+            'code_challenge_methods_supported': ['S256'],
             'claims_supported': [
                 'iss',
                 'aud',

src/tests/base/test_customer_oidc_rp.py

@@ -236,7 +236,8 @@ def provider(organizer):
                 "response_modes_supported": ["query"],
                 "grant_types_supported": ["authorization_code"],
                 "scopes_supported": ["openid", "email", "profile"],
-                "claims_supported": ["email", "sub"]
+                "claims_supported": ["email", "sub"],
+                "code_challenge_methods_supported": ["plain", "S256"],
             }
         }
     )
@@ -256,6 +257,19 @@ def test_authorize_url(provider):
     ) == oidc_authorize_url(provider, "state_val", "https://redirect?foo=bar", "pkce_value")
 
 
+@pytest.mark.django_db
+def test_authorize_url_no_pkce(provider):
+    del provider.configuration["provider_config"]["code_challenge_methods_supported"]
+    assert (
+        "https://example.com/authorize?"
+        "response_type=code&"
+        "client_id=abc123&"
+        "scope=openid+email+profile&"
+        "state=state_val&"
+        "redirect_uri=https%3A%2F%2Fredirect%3Ffoo%3Dbar"
+    ) == oidc_authorize_url(provider, "state_val", "https://redirect?foo=bar", "pkce_value")
+
+
 @pytest.mark.django_db
 @responses.activate
 def test_validate_authorization_invalid(provider):