Ручная настройка

import express from "express";
import session from "express-session";
import * as oidc from "openid-client";

const REDIRECT_URI = process.env.PASPO_REDIRECT_URI!; // https://app.example.com/auth/paspo/callback
const config = await oidc.discovery(
  new URL("https://paspo.id"),
  process.env.PASPO_CLIENT_ID!,
  process.env.PASPO_CLIENT_SECRET!,
);

const app = express();
app.use(session({ secret: process.env.SESSION_SECRET!, resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: "lax" } }));

app.get("/auth/paspo/login", async (req, res) => {
  const codeVerifier = oidc.randomPKCECodeVerifier();
  const state = oidc.randomState();
  const nonce = oidc.randomNonce();
  req.session.paspo = { codeVerifier, state, nonce };

  const url = oidc.buildAuthorizationUrl(config, {
    redirect_uri: REDIRECT_URI,
    scope: "openid email",
    code_challenge: await oidc.calculatePKCECodeChallenge(codeVerifier),
    code_challenge_method: "S256",
    state,
    nonce,
  });
  res.redirect(url.href);
});

app.get("/auth/paspo/callback", async (req, res) => {
  const pending = req.session.paspo;
  delete req.session.paspo;
  if (!pending) return res.redirect("/login?error=paspo");

  try {
    const tokens = await oidc.authorizationCodeGrant(
      config,
      new URL(req.originalUrl, REDIRECT_URI),
      { pkceCodeVerifier: pending.codeVerifier, expectedState: pending.state, expectedNonce: pending.nonce },
    );
    const claims = tokens.claims()!;
    const user = await upsertUserByPaspoSub(claims.sub, claims); // your DB
    req.session.regenerate(() => {
      req.session.userId = user.id;
      res.redirect("/");
    });
  } catch {
    res.redirect("/login?error=paspo");
  }
});

import NextAuth from "next-auth";

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    {
      id: "paspo",
      name: "Paspo",
      type: "oidc",
      issuer: "https://paspo.id",
      clientId: process.env.AUTH_PASPO_ID,
      clientSecret: process.env.AUTH_PASPO_SECRET,
      authorization: { params: { scope: "openid email" } },
      checks: ["pkce", "state", "nonce"],
    },
  ],
});

INSTALLED_APPS += ["allauth.socialaccount.providers.openid_connect"]

SOCIALACCOUNT_PROVIDERS = {
    "openid_connect": {
        "OAUTH_PKCE_ENABLED": True,
        "APPS": [
            {
                "provider_id": "paspo",
                "name": "Paspo",
                "client_id": os.environ["PASPO_CLIENT_ID"],
                "secret": os.environ["PASPO_CLIENT_SECRET"],
                "settings": {"server_url": "https://paspo.id", "scope": ["openid", "email"]},
            }
        ],
    }
}

spring:
  security:
    oauth2:
      client:
        registration:
          paspo:
            client-id: ${PASPO_CLIENT_ID}
            client-secret: ${PASPO_CLIENT_SECRET}
            authorization-grant-type: authorization_code
            scope: openid,email
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          paspo:
            issuer-uri: https://paspo.id

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = "paspo";
    })
    .AddCookie()
    .AddOpenIdConnect("paspo", options =>
    {
        options.Authority = "https://paspo.id";
        options.ClientId = builder.Configuration["Paspo:ClientId"];
        options.ClientSecret = builder.Configuration["Paspo:ClientSecret"];
        options.ResponseType = "code";
        options.UsePkce = true;
        options.CallbackPath = "/auth/paspo/callback";
        options.Scope.Clear();
        options.Scope.Add("openid");
        options.Scope.Add("email");
        options.MapInboundClaims = false;
    });