Repository navigation
Fix OpenID Connect dynamic client registration conformance issues - #354
Merged
Merged
Conversation
RFC 7591 and OIDC Dynamic Client Registration define the jwks client metadata as a JSON object, but registration only accepted a string containing JSON, rejecting standard requests with invalid_client_metadata. Accept the object form (keeping the legacy string form), require a keys array, and return jwks as an object in registration responses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Client assertions were verified via verifyJwtIdentity, which chooses between shared-secret and public-key verification based on the client's ID token signing algorithm. Clients with an HMAC ID token algorithm (the dynamic registration default) therefore failed private_key_jwt authentication with a server error. Add a dedicated verifyClientAssertion that always uses the client's public keys and accepts only asymmetric signatures, so an assertion signed with the client secret is never accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
OpenID Connect Dynamic Client Registration specifies RS256 as the default ID token signing algorithm when the client does not request one, but Wren:AM defaulted to HS256. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The registration_client_uri returned by dynamic client registration was built from the host and the first path segment of the request, dropping the realm, so clients registered in a sub-realm could not read their registration. Build it from the realm-aware client registration endpoint instead, as advertised in the discovery document. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jwksas a JSON object – RFC 7591 / OIDC DCR definejwksas an object, but registration only accepted a string containing JSON and rejected standard requests withinvalid_client_metadata. The legacy string form is still accepted. Registration responses now returnjwksas an object.private_key_jwtassertions by the client's public keys – the verification method was picked from the client's ID token signing algorithm, so clients with HS256 ID tokens failedprivate_key_jwtauthentication with a server error. Client assertions are now always verified against the client's public keys, and only asymmetric signatures are accepted.id_token_signed_response_algto RS256 – as specified by OIDC DCR §2 (it was HS256).registration_client_uri– the URI dropped the realm, so clients registered in a sub-realm could not read their registration.These issues were identified by OIDF Conformance Suite. There are other gaps, but those are mainly about missing features rather than errors in existing funcionality.