Abstract
This specification defines the metadata requirements for OAuth 2.0 Clients, Authorization Servers and Protected Resources participating in Federationskontext BAS, a federation context for machine-to-machine access within the Swedish public sector. The metadata is published in Entity Configurations according to OpenID Federation 1.1. The requirements apply to the Resolved Metadata, meaning the metadata that results once the Trust Chain of an Entity has been applied to the declarations the Entity makes about itself. The primary purpose of the requirements is that a party can verify the system identity of an Entity and the organization it is registered for. The requirements also support interoperability according to the Ena OAuth 2.0 Interoperability Profile, and the registration of Clients at Authorization Servers, in that identifiers, keys, authentication methods, endpoints and algorithms are obtained from Resolved Metadata rather than agreed bilaterally. They do not regulate the information exchange that follows, including which scopes are defined or requested and what access a Client is granted.
...
The table below covers the metadata parameters that Clients, Authorization Servers and Protected Resources publish with the same meaning in their oauth_client, oauth_authorization_server and oauth_resource metadata, respectively. These parameters describe the Entity and the organization behind it, and are defined in Section 5.2.2 of [OpenID.Federation]. Some of these values are verified when an Entity is registered, see Section 2.
Parameter | Description | Requirement | Defined in |
|---|---|---|---|
organization_name | The name of the organization that owns the Entity. The value given without a language tag MUST be the legal name of the organization. Human-readable names for Swedish (#sv) and English (#en) MAY also be given. | REQUIRED. Assigned by the Federation Registration Entity. OPTIONAL for the Entity to supply. | Section 5.2.2 of [OpenID.Federation] |
organization_identifier | A unique identifier for the organization that owns the Entity. The value MUST contain the ten-digit Swedish organization number within an ISO/IEC 6523 [ISO.6523] GLUE-URI [I-D.ietf-spice-glue-id], see Section 3.1. | REQUIRED. Assigned by the Federation Registration Entity. OPTIONAL for the Entity to supply. | Section 2 of [OIDC.Sweden.OrgId] |
display_name
A human-readable name of the Entity, provided in Swedish and English, see Section 2. If the Entity does not supply it, the Federation Registration Entity takes the value from client_name or resource_name.
REQUIRED if the display name has been verified under [SIB.Registration]. Assigned by the Federation Registration Entity. OPTIONAL for the Entity to supply.
Section 5.2.2 of [OpenID.Federation]
contacts | Contact addresses for the people or groups responsible for operating the Entity. The value MUST hold at least one email address. |
OPTIONAL | Section 5.2.2 of [OpenID.Federation] and Section 2 of [RFC7591] (for Clients) | ||
organization_uri | A URL to a web page for the organization that owns the Entity. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] |
logo_uri | A URL referencing a logotype for the Entity. The URL MUST use the HTTPS scheme. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] and Section 2 of [RFC7591] (for Clients) |
description | A brief human-readable description of the Entity. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] |
keywords | Search keywords, tags, or categories that apply to the Entity. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] |
policy_uri | A URL to the documentation of conditions and policies that are relevant to the Entity. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] and Section 2 of [RFC7591] (for Clients) |
information_uri | A URL to further documentation about the Entity. | OPTIONAL | Section 5.2.2 of [OpenID.Federation] |
Table 1: Organization and informational metadata parameters.
...
The table below covers the metadata parameters that a Client publishes in its oauth_client metadata, in addition to those in Section 3. The parameters are defined in Section 2 of [RFC7591], and profiled by Section 2.2.2 of [Ena.OAuth2]. This version of the document covers Clients that use the client_credentials grant, which is the grant type that [BAS.Rules] permits. Parameters that apply only to other grant types, such as redirect_uris, require_signed_request_object and require_pushed_authorization_requests, are therefore not used. The token_endpoint_auth_signing_alg parameter defined by [OpenID.Registration] is not used either, since a Client in BAS does not declare the algorithm it signs with, see Section 4.2.
Parameter | Description | Requirement | Defined in |
|---|---|---|---|
token_endpoint_auth_method | The method by which the Client authenticates at the token endpoint of an Authorization Server. The value MUST be private_key_jwt, see Section 4.2. | REQUIRED. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC7591] and Section 2.2.2.2 of [Ena.OAuth2] |
jwks | The Client's JSON Web Key Set, included by value. The Client MUST publish its keys using either jwks or jwks_uri, but not both, see Section 2.2.2.4 of [Ena.OAuth2]. The keys MUST meet the requirements of [BAS.Security]. | REQUIRED, unless jwks_uri is used. | Section 2 of [RFC7591] and Section 5.2.1 of [OpenID.Federation] |
jwks_uri | A URL from which the Client's JSON Web Key Set can be retrieved. The URL MUST use the HTTPS scheme. The keys MUST meet the requirements of [BAS.Security]. | REQUIRED, unless jwks is used. | Section 2 of [RFC7591] and Section 5.2.1 of [OpenID.Federation] |
grant_types | The grant types that the Client uses. The value MUST contain client_credentials. Without this parameter, [RFC7591] and [Ena.OAuth2] assume the authorization_code grant type. | REQUIRED. Constrained by the Trust Anchor metadata policy to the grant types that [BAS.Rules] permits. | Section 2 of [RFC7591] and Section 2.2.2.3 of [Ena.OAuth2] |
redirect_ |
uris | Array of redirection URIs for use in redirect-based flows | REQUIRED if the client is registered for the authorization_code grant type | Section 2 of [RFC7591] and Section 2.2.2.1 of [Ena.OAuth2] |
response_types | The response types that the Client uses. The value MUST be an empty array, since the client_credentials grant uses no response type. Without this parameter, [RFC7591] assumes the code response type. | REQUIRED. Assigned by the Trust Anchor metadata policy. OPTIONAL for the Client to supply. | Section 2 of [RFC7591] |
client_name | A human-readable name of the Client, provided in Swedish and English, see Section 2. If display_name is not supplied, its value is taken from client_name, see Section 3. | OPTIONAL | Section 2 of [RFC7591] and Section 2.2.2.6 of [Ena.OAuth2] |
scope | The scope values that the Client can use when requesting access tokens. The values are agreed between the parties to an exchange, see Section 1.3. | OPTIONAL | Section 2 of [RFC7591] and Section 2.2.2.5 of [Ena.OAuth2] |
dpop_bound_access_tokens | Whether the Client always uses DPoP [RFC9449] when requesting access tokens. A Client that does so MUST set this parameter to true. | OPTIONAL | Section 5.2 of [RFC9449] and Section 2.2.2.7 of [Ena.OAuth2] |
tls_client_certificate_bound_access_tokens | Whether the Client requests access tokens bound to its TLS client certificate [RFC8705]. A Client that does so MUST set this parameter to true. | OPTIONAL | Section 3.4 of [RFC8705] and Section 2.2.2.7 of [Ena.OAuth2] |
Table 2: Client metadata parameters.
...
An Authorization Server also publishes its metadata at the location stated in Section 3.1.2 of [Ena.OAuth2]. For every parameter that appears in both, the metadata published there MUST be consistent with the Authorization Server's Resolved Metadata. Where the Trust Anchor metadata policy removes values that the Authorization Server supports outside BAS, such as other grant types or client authentication methods, the value in the Resolved Metadata is a subset of the published value, and the two are consistent in this sense.
Parameter | Description | Requirement | Defined in |
|---|---|---|---|
issuer | The issuer identifier of the Authorization Server. The value MUST be equal to the Authorization Server's Entity Identifier, see Section 5.1.3 of [OpenID.Federation.Connect], and MUST meet the requirements of Section 3.1.1.1 of [Ena.OAuth2]. | REQUIRED | Section 2 of [RFC8414] and Section 3.1.1.1 of [Ena.OAuth2] |
token_endpoint | The URL of the token endpoint. | REQUIRED | Section 2 of [RFC8414] and Section 3.1.1.2 of [Ena.OAuth2] |
jwks_uri | A URL from which the Authorization Server's JSON Web Key Set can be retrieved. The URL MUST use the HTTPS scheme. The keys MUST meet the requirements of [BAS.Security]. | REQUIRED | Section 2 of [RFC8414] and Section 3.1.1.3 of [Ena.OAuth2] |
grant_types_supported | The grant types that the Authorization Server supports. The value MUST contain client_credentials. Without this parameter, [Ena.OAuth2] assumes the authorization_code grant type. | REQUIRED. Constrained by the Trust Anchor metadata policy to the grant types that [BAS.Rules] permits. | Section 2 of [RFC8414] and Section 3.1.1.5 of [Ena.OAuth2] |
response_types_supported | The response types that the Authorization Server supports. The value is not constrained within BAS, since the client_credentials grant uses no response type. | REQUIRED | Section 2 of [RFC8414] |
token_endpoint_auth_methods_supported | The client authentication methods that the token endpoint supports. The value MUST be private_key_jwt only, see Section 2 of [BAS.Security]. | REQUIRED. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.6 of [Ena.OAuth2] |
token_endpoint_auth_signing_alg_values_supported | The signature algorithms that the token endpoint supports for private_key_jwt. See Section 3.1 of [BAS.Security]. | REQUIRED. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.7 of [Ena.OAuth2] |
scopes_supported | The scope values that the Authorization Server supports. The values are agreed between the parties to an exchange, see Section 1.3. | REQUIRED | Section 2 of [RFC8414] and Section 3.1.1.4 of [Ena.OAuth2] |
revocation_endpoint | The URL of the revocation endpoint. | OPTIONAL | Section 2 of [RFC8414] |
revocation_endpoint_auth_methods_supported | The client authentication methods that the revocation endpoint supports. The value MUST be private_key_jwt only, see Section 2 of [BAS.Security]. | REQUIRED if revocation_endpoint is present. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.6 of [Ena.OAuth2] |
introspection_endpoint
The URL of the introspection endpoint.
OPTIONAL
Section 2 of [RFC8414]
introspection_endpoint_auth_methods_supported
revocation_endpoint_auth_signing_alg_values_supported | Signing algorithms supported by this endpoint for the signature on the JWT, when used with private_key_jwt client authentication. | REQUIRED if revocation_endpoint is present. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.7 of [Ena.OAuth2] |
introspection_endpoint | The URL of the introspection endpoint. | OPTIONAL | Section 2 of [RFC8414] |
introspection_endpoint_auth_methods_supported | The client authentication methods that the introspection endpoint supports. The |
value MUST be private_key_jwt only, see Section 2 of [BAS.Security]. | REQUIRED if introspection_endpoint is present. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.6 of [Ena.OAuth2] |
introspection_endpoint_auth_signing_alg_values_supported | Signing algorithms supported by this endpoint for the signature on the JWT, when used with private_key_jwt client authentication. | REQUIRED if introspection_endpoint is present. Constrained by the Trust Anchor metadata policy. | Section 2 of [RFC8414] and Section 3.1.1.7 of [Ena.OAuth2] |
dpop_signing_alg_values_supported | The signature algorithms that the Authorization Server supports for DPoP proofs. An Authorization Server that supports DPoP MUST publish this parameter. | REQUIRED if DPoP is supported. | Section 5.1 of [RFC9449] and Section 3.1.1.10 of [Ena.OAuth2] |
tls_client_certificate_bound_access_tokens | Whether the Authorization Server supports access tokens bound to TLS client certificates. | OPTIONAL | Section 3.3 of [RFC8705] and Section 3.1.1.10 of [Ena |
mtls_endpoint_aliases
.OAuth2] | |||
mtls_endpoint_aliases | Alternative endpoints for use with mutual TLS. | OPTIONAL | Section 5 of [RFC8705] and Section 3.1.1.10 of [Ena.OAuth2] |
protected_resources | The resource identifiers of the Protected Resources that the Authorization Server issues access tokens for. | RECOMMENDED | Section 4 of [RFC9728] and Section 3.1.1.10 of [Ena.OAuth2] |
require_signed_request_object | Indicates whether authorization request needs to be protected as Request Object and provided through either request or request_uri parameter | OPTIONAL | Section 10.5 of [RFC9101] and Section 7.2 of [Ena.OAuth2] |
require_pushed_authorization_requests | Boolean parameter indicating whether the authorization server accepts authorization request data only via PAR. If omitted, the default value is false |
. | OPTIONAL | Section 5 of [ |
protected_resources
The resource identifiers of the Protected Resources that the Authorization Server issues access tokens for.
RECOMMENDED
RFC9126] | |||
pushed_authorization_request_endpoint | The URL of the pushed authorization request endpoint at which a client can post an authorization request to exchange for a request_uri value usable at the authorization server | OPTIONAL | Section 5 of [RFC9126 |
] and Section 3.1.1. |
2 of |
Table 3: Authorization Server metadata parameters.
...
The table below covers the metadata parameters that a Protected Resource publishes in its oauth_resource metadata, in addition to those in Section 3. The parameters are defined in Section 2 of [RFC9728], which Section 5.1.5 of [OpenID.Federation.Connect] makes available to oauth_resource metadata, and profiled by Section 4.3 of [Ena.OAuth2].
Parameter | Description | Requirement | Defined in |
|---|---|---|---|
resource | The resource identifier of the Protected Resource, see Section 6.1. | REQUIRED | Section 2 of [RFC9728] and Section 4.3 of [Ena.OAuth2] |
authorization_servers | The issuer identifiers of the Authorization Servers that issue access tokens for the Protected Resource. The value MUST contain the Entity Identifier of at least one Authorization Server in BAS. | OPTIONAL | Section 2 of [RFC9728] |
jwks_uri | A URL from which the Protected Resource's JSON Web Key Set can be retrieved. The URL MUST use the HTTPS scheme. The keys MUST meet the requirements of [BAS.Security]. | OPTIONAL | Section 2 of [RFC9728] and Section 5.2.1 of [OpenID.Federation] |
resource_name | A human-readable name of the Protected Resource, provided in Swedish and English, see Section 2. If display_name is not supplied, its value is taken from resource_name, see Section 3. |
RECOMMENDED | Section 2 of [RFC9728] | ||
scopes_supported | The scope values that the Protected Resource uses. The values are agreed between the parties to an exchange, see Section 1.3. | RECOMMENDED | Section 2 of [RFC9728] |
bearer_methods_supported | The methods by which the Protected Resource accepts access tokens. If present, the value MUST include header and body, see Section 4 of [Ena.OAuth2]. | OPTIONAL | Section 2 of [RFC9728] |
dpop_bound_access_tokens_required | Whether the Protected Resource requires DPoP-bound access tokens. A Protected Resource that does so MUST set this parameter to true. | OPTIONAL | Section 2 of [RFC9728] |
dpop_signing_alg_values_supported | The signature algorithms that the Protected Resource supports for DPoP proofs. A Protected Resource that supports DPoP MUST publish this parameter. | OPTIONAL | Section 2 of [RFC9728] |
tls_client_certificate_bound_access_tokens | Whether the Protected Resource supports access tokens bound to TLS client certificates. A Protected Resource that requires such tokens MUST set this parameter to true. | OPTIONAL | Section 2 of [RFC9728] |
Table 4: Protected Resource metadata parameters.
...
The parameters below hold values that differ from one Entity to the next. A Federation Registration Entity sets them in the Subordinate Statement it issues for the Entity, having performed the checks of [SIB.Registration]. The values are set in the metadata Claim of the Subordinate Statement, under the Entity Type of the Entity, and replace any value the Entity declares itself. A verified value is held fixed: the Entity cannot change it without a new verification under [SIB.Registration].
Parameter | Set when | Value |
|---|---|---|
organization_name | Always. Verified under verification of organisational affiliation. | The legal name of the organization, without a language tag. The #sv and #en values are set if the Federation Member has supplied them. |
organization_identifier | Always. Verified under verification of organisational affiliation. | The organization number of the Federation Member, in the format of Section 3.1. |
Table 5: Parameters set per Entity by a Federation Registration Entity.
The Federation Registration Entity also includes the registration_policy Claim defined in [OpenID.Federation.RegPolicy] in the Subordinate Statement. The Claim MUST list the registration policy URI of every check that has been performed for the Entity. The URIs are defined in [SIB.Registration]:
Check | Registration policy URI |
|---|---|
Verification of organisational affiliation | |
Verification of registration submitter | To be assigned in [SIB.Registration] |
Table 6: Registration policy URIs.
...