Feature request: Allow OpenID document overrides in case of incomplete OIDC implementations

[Nezteb]

Some OIDC providers (Microsoft) do not have spec-compliant discovery documents, and require patching in order to fully validate tokens.

Relevant code I found from a quick skim:

• https://github.com/DockYard/openid_connect/blob/v1.0.0/lib/openid_connect.ex#L245
• https://github.com/DockYard/openid_connect/blob/v1.0.0/lib/openid_connect/document.ex#L29

Perhaps some sort of middleware step that lets the user define a post-fetch function that operates on the document?

Example of another OIDC library's implementation of document overrides:

• https://hexdocs.pm/oidcc/oidcc_provider_configuration.html#t:quirks/0-exceptions
• Advice on using with Azure B2C OIDC, which lacks the OpenID configuration key `code_challenge_methods_supported` erlef/oidcc#377 (comment)

[bcardarella]

either middleware or adapter. Adapter may be more flexible ultimately

[bcardarella]

on a side note, wasn't the entire point of openid connect was to force spec compliancy because the clients can just adapter to the auth endpoint?

[Nezteb]

wasn't the entire point of openid connect was to force spec compliancy because the clients can just adapter to the auth endpoint?

I wish. I've only ever encountered this particular issue with a single provider's PKCE implementation.