Support dynamic client registration #17
Description
This issue was originally created by @sandhose at matrix-org/matrix-authentication-service#17.
Support for RFC7591.
See MSC2966.
This is the step where client register themselves and provide metadata about them.
What needs to be supported according to the OIDC conformance profile:
https://openid.net/wordpress-content/uploads/2018/06/OpenID-Connect-Conformance-Profiles.pdf
- ID Token
- Asymmetric ID Token signature with RS256
- UserInfo Endpoint
- Can provide signed UserInfo response with RS256
- redirect_uri
- Reject request without redirect_uri when multiple registered
- Preserves query parameter in redirect_uri
- Preserves query parameter in registered redirect_uris
- Reject redirect_uri when query parameter does not match
- Reject redirect_uri when query parameter added
- Reject registration of redirect_uris with fragment
- Discovery
- Publishes openid-configuration discovery information
- Config has issuer
- Discovered issuer matches openid-configuration path prefix
- Discovered issuer matches ID Token iss value
- Config has authorization_endpoint
- Config has token_endpoint
- Config has userinfo_endpoint
- Config has jwks_uri
- Keys in OP JWKs well formed
- Config has scopes_supported
- Config has response_types_supported
- Config has subject_types_supported
- Config has id_token_signing_alg_values_sup ported
- Config has claims_supported
- All OP endpoints use https
- Can Discover Identifiers using E- Mail Syntax
- Support WebFinger discovery
- Dynamic Client Registration
- Config has registration_endpoint
- Enables dynamic registration
- Support using Sector Identifier for pairwise sub values
- Displays logo_uri in login page
- Displays policy_uri in login page
- Displays tos_uri in login page
- Uses keys registered with jwks value
- Uses keys registered with jwks_uri value
- Reject Sector Identifier not containing registered redirect_uri values
- Key Rotation
- Can rotate OP signing key
- Support RP signing key rotation
- request_uri Request Parameter
- Support request_uri request parameter
- Support request_uri request parameter with unsecured request
- Support request_uri request parameter with signed request