Page History

issuer

MUST be a globally unique URL.
”Corresponds” to where the authorization server metadata is located.

REQUIRED
The issuer parameter value in the oauth_authorization_server metadata MUST match the Federation Entity Identifier (the iss Claim in the Entity Configuration)

[RFC8414], REQUIRED

[OpenID.Fed.OIDC]
REQUIRED

grant_types_supported

Supported Grant Types

OPTIONAL
The same requirements as specified in Section 2 of [RFC8414], with the following exception:

If the parameter is omitted, the default value SHALL be [ "authorization_code" ].

[RFC8414], OPTIONAL, ["authorization_code", "implicit"] is default if not present

Note: [Ena.OAuth]: If the parameter is omitted, the default value SHALL be "authorization_code"

Could it be a risk to change the default of the standard?

token_endpoint

Endpoint for requesting access tokens

REQUIRED

[RFC8414], REQUIRED

token_endpoint_auth_methods_supported

Client authentication methods supported by the token endpoint.

REQUIRED and MUST include private_key_jwt.

[RFC8414] OPTIONAL, client_secret_basic is default if not present

In line with the security requirements

token_endpoint_auth_signing_alg_values_supported

JWS signing algorithms for client authentication supported by the token endpoint.

REQUIRED
and MUST conform to the signature requirements (separately specified)

[RFC8414] REQUIRED when private_key_jwt is used.

scopes_supported

scopes supported by the authorization server

REQUIRED
SHOULD list all scopes supported by the authorization server

[RFC8414] , RECOMMENDED

[Ena.OAuth]
REQUIRED

What is the rationale for this sharper requirement in Ena.OAuth?

dpop_signing_alg_values_supported

JWS algorithms supported for DPoP proof JWTs.
Signals that the authorization server supports the DPoP mechanism.

RECOMMENDED

[Ena.OAuth]
RECOMMENDED
The use of DPoP is recommended to mitigate replay attacks.

authorization_response_iss_parameter_supported

indicates whether the authorization server supports including the issuer parameter in authorization responses to protect against Authorization Server Mix-Up Attacks

SHOULD

OPTIONAL?

[RFC9207]

[Ena.OAuth]
SHOULD be used and be set to true, for authorization servers within a federation

issuer is already required, so this could be OPTIONAL because this is only an indication?

jwks

The Entity's JSON Web Key Set, representing the Entity's protocol keys, included by value in the metadata.

REQUIRED if jwks_uri is not provided

[OpenID.Fed]

[Ena.OAuth], and [RFC8414]
does NOT include this.

Not supported?

jwks_uri

URL referencing a JWK Set document containing the Entity's protocol keys for that Entity Type

REQUIRED if jwks is not provided

[OpenID.Fed]
REQUIRED if jwks is not provided

[RFC8414]
OPTIONAL

[Ena.OAuth]
REQUIRED

[Ena.OAuth] has this as the only option - why?

signed_jwks_uri

URL referencing a signed JWT having the Entity's JWK Set document, representing the Entity's protocol keys for that Entity Type as its payload

OPTIONAL

[OpenID.Fed]

[Ena.OAuth], and [RFC8414]
does NOT include this.

Not supported?

authorization_endpoint

URL of the authorization server's authorization endpoint

REQUIRED IF authorization code grant type is supported.

[RFC8414] REQUIRED
unless no grant types are supported that use the authorization endpoint

Out of cope for SIB BAS Step 1, but should be included.

code_challenge_methods_supported

PKCE [RFC7636] code challenge methods supported

REQUIRED IF authorization code grant type is supported.

[RFC8414] OPTIONAL

[Ena.OAuth]
REQUIRED for authorization code grant.

ui_locales_supported

Languages and scripts supported for the user interface

SHOULD
and should include Swedish (sv) and English (en).

[RFC8414] OPTIONAL

[Ena.OAuth] SHOULD.

Should only be relevant if the authorization endpoint is supported.

pushed_authorization_request_endpoint

URL of the authorization server's endpoint for pushed authorization requests

REQUIRED IF pushed authorization requests are supported.

Section 5 of [RFC9126] (extension)

[Ena.OAuth]
CONDITIONAL

protected_resources

resource identifiers for OAuth protected resources as defined Section 4 of [RFC9728]

OPTIONAL

[Ena.OAuth]
RECOMMENDED

An extension to RFC8414.

registration_endpoint

URL of the authorization server's OAuth 2.0 Dynamic Client Registration endpoint

OPTIONAL

[RFC8414] OPTIONAL

revocation_endpoint

URL of the authorization server's revocation endpoint

OPTIONAL

[RFC8414] OPTIONAL

revocation_endpoint_auth_methods_supported

client authentication methods supported by this revocation endpoint

OPTIONAL

[RFC8414] OPTIONAL

revocation_endpoint_auth_signing_alg_values_supported

signing algorithms supported by this endpoint for the signature on the JWT, when used with private_key_jwt

OPTIONAL

[RFC8414] OPTIONAL

introspection_endpoint

URL of the authorization server's introspection endpoint

OPTIONAL

[RFC8414] OPTIONAL

introspection_endpoint_auth_methods_supported

signing algorithms client authentication methods supported by this endpoint for the signature on the JWT, when used with private_key_jwt

OPTIONAL

[RFC8414] OPTIONALmtls

introspection_endpoint_auth_signing_alg_values_supported

signing algorithms supported by this endpoint for the signature on the JWT, when used with private_key_jwt

OPTIONAL

[RFC8414] OPTIONAL

mtls_endpoint_aliases

OPTIONAL

[

OPTIONAL

[Ena.OAuth]
SHOULD if Mutual TLS is supported for client authentication.

tls_client_certificate_bound_access_tokens

indicates authorization server support for mutual TLS client certificate-bound access tokens

OPTIONAL

Section 3.3 of [RFC8705]

[RFC8705] Mutual-TLS client certificate-Bound Access Tokens does not combine well with private_key_jwt.

require_signed_request_object

indicates where whether authorization request needs to be protected as Request Object and provided through either request or request_uri parameter

OPTIONAL

Section 10.5 of [RFC9101]

[Ena.OAuth]
Section 3.1.1.10 and
Section 7.2, JAR – JWT-Secured Authorization Requests.

require_pushed_authorization_requests

Boolean parameter indicating whether the authorization server accepts authorization request data only via PAR. If omitted, the default value is false.

OPTIONAL

Section 5 of [RFC9126].

Section ??? of 
[Ena.OAuth]

pushed_authorization_request_endpoint

The URL of the pushed authorization request endpoint at which a client can post an authorization request to exchange for a request_uri value usable at the authorization server

OPTIONAL

Section 5 of [RFC9126].

Section 3.1.1.2 of [Ena.OAuth]