IdentityModel/oidc-client-js is deprecated

[krzema12]

Hi!

The core dependency of this library - https://github.com/IdentityModel/oidc-client-js - has been deprecated. The repository is already archived. See the README:

Looking for a new maintainer

I've been working as the main and (for the most part) only individual on this project for 6+ years. Much has changed since then > in the work of JavaScript and many updates are needed here. I no longer have the time to keep up and maintain this library and > project (well, really haven't for some time now as many know).

As such, I plan to disable PRs and won't be responding to issues going forward. The repo will be archived by the end of the year.

If anyone wishes to step up and maintain this project, then that is very welcome! I suggest forking and then once there's a track > record for such a commitment I would be happy to provide a link to your new repo letting people know that it is now maintained > elsewhere.

Please contact me if you're interested in doing this: @BrockLAllen

So long and thanks for all the fish.

Since this library is a wrapper, the deprecation sort of bubbles up to this library. My immediate problem is that I have an issue with this library and suspecting that the root cause sits in https://github.com/IdentityModel/oidc-client-js, I cannot even create a GitHub issue

What do we do now? 👀

re IdentityModel/oidc-client-js#1391

[simenandre]

Hey, thank you so much for bringing this up.

I've thought about this for quite some time now. Honestly, I don't know yet. I just wanted to touch base on this, so you and others know it's this project isn't left. I want to keep maintaining oidc-react for the foreseeable future.

IMHO, there are two alternatives. Search the world for a replacement for oidc-client-js, make a replacement on our own or create a fork of oidc-client-js.

Since building this library, and being hired as a consultant on OIDC/OAuth jobs for quite some years, I feel I could build an alternative. Maybe using some newer methods and technologies, getting an improved experience. I might wanna do that, but not alone. Now for the other two alternatives. Taking over oidc-client-js feels very cumbersome (read: time-consuming). We can also wait and see if someone takes over oidc-client-js.

Regarding finding a replacement; I like that oidc-client-js is certified. node-openid-client is the only other alternative, and that's built for Node 🤷‍♂️

No matter what we do, I'm sure oidc-react will stay as lightweight as possible. Personally, I like when tools are build using building blocks, not specialized for one provider (like the case of Azure, Google, Auth0 clients). What does everyone else think? What would you do?

[pseudoramble]

My perspective:

Short term, it seems reasonable to either stick with oidc-client-js as it is, or fork it and build oidc-react from the fork. That at least keeps the project running in its current state, and oidc-client-js probably does not need tons of changes at this point. There are quite a few issues open with them, but many seem to be questions or enhancements.

Long term, I'm not sure. It's certainly a big ask to take on maintenance of that library or to create a separate one. Ideally oidc-react could support oidc-client-js and its new owners. That way it could keep using the same library.

[janhoy]

This fork seems to be actively maintained and ported to TS https://github.com/pamapa/oidc-client-ts

[simenandre]

This fork seems to be actively maintained and ported to TS pamapa/oidc-client-ts

Thanks for pointing that out. I'm not sure about it, honestly.

I'm not sure about the longevity of the fork, we'll have to see. I feel I need to check-in with @pamapa about his ideas and how they'll match with the goals of oidc-react. However, if anyone is eager, the same developer has forked our library too, https://github.com/pamapa/react-oidc-context.

[hosseinmd]

pamapa/oidc-client-ts look good

[simenandre]

@hosseinmd thanks for pitching in. I'm following closely the oidc-client fork that pamapa has created, still not sure if that is the best approach.

Right now, there is much interest in «what replaces oidc-client», therefore I'm sceptical of the longevity of these early forks in general. I'm not sure they will stay as nicely maintained as oidc-react has been. We had a burst of contributes from pamapa earlier too, but it didn't last. These things make me torn as to what to do. I'm eager to hear more feedback from the community on the subject.

Maybe someone wants to do some simple research, and find other forks. Maybe there are more options?

[janhoy]

I’m considering https://github.com/ForgeRock/appAuthHelper as an alternative that looks more future safe, although quite different.

[simenandre]

I’m considering ForgeRock/appAuthHelper as an alternative that looks more future safe, although quite different.

AFAIK, that is a wrapper on top of AppAuth-JS which seems like an option. I haven't seen that before. Thanks for that, @janhoy!