Work around double parsing of ui_locales

[jaap3]

Fixes #1468

Description of the Change

Makes sure credential["ui_locales"] is a string before passing it to oauthlib.

oauthlib always calls split on the values of ui_locales:

https://github.com/oauthlib/oauthlib/blob/d319c54ae0342d9a2596ef7afa1e17984c303550/oauthlib/openid/connect/core/grant_types/base.py#L317

The way django-oauth-toolkit is structured the credentials dictionary contains the value of ui_locales as processed by oauthlib, which makes it a list. It is then passed back into oauthlib which tries to parse it again, resulting in an AttributeError.

oauthlib is a bit more careful with the way it handles the prompt parameter:

https://github.com/oauthlib/oauthlib/blob/d319c54ae0342d9a2596ef7afa1e17984c303550/oauthlib/openid/connect/core/grant_types/base.py#L289-L292

So this might be a bug in the way oauthlib handles the incoming ui_locales parameter.

Checklist

• PR only contains one change (considered splitting up PR)
• unit-test added
• documentation updated
• CHANGELOG.md updated (only for user relevant changes)
• author name in AUTHORS

[jaap3]

I didn't really know where to put the tests, so it is in it's own module.

[n2ygk]

I'm wondering if it would be more appropriate to push this upstream to oauthlib? Oh I just noticed you already did that!

[jaap3]

As mentioned in the upstream PR, it's unclear whether this issue stems from a bug in oauthlib or a potential misuse of the oauthlib API by django-oauth-toolkit (DOT). The problem occurs when DOT creates the credentials dictionary from what oauthlib refers to as request_info, and then passes that back into oauthlib.

The multiple layers in DOT and oauthlib make the process quite confusing and challenging to follow, not to mention debug. Therefore, I opted to work around the issue as close to the point of failure as possible.

I’m waiting for feedback on the oauthlib side. In the meantime, we wrote a middleware that removes ui_locales from the querystring using a redirect. It's not ideal, but at least OIDC works.

[n2ygk]

Let's go ahead and merge this fix here and keep an eye on whether oauthlib implements the fix there in the future at which point this change can potentially be reverted.
Thanks for this!

[jaap3]

Thanks!