- RP metadata unnecessarily requires a value for response_typesJOIDC-240Henri Mikkonen
- Add attributeRecipientGroupID to profile config(s)JOIDC-239Henri Mikkonen
- Release 4.2.1JOIDC-238Resolved issue: JOIDC-238Henri Mikkonen
- IllegalStateException in view-state CallFrontChannelLogoutUriViewJOIDC-237Resolved issue: JOIDC-237Henri Mikkonen
- Audit logging for OAuth2Client login flowJOIDC-236Henri Mikkonen
- AdministrativeLogoutConfiguration for OIDCJOIDC-235Henri Mikkonen
- Possible race condition when processing login_hint or resource -parameters in authorization endpointJOIDC-234Resolved issue: JOIDC-234Henri Mikkonen
- Release 4.2.0JOIDC-233Resolved issue: JOIDC-233Henri Mikkonen
- Protocol trace log only display first parameter valueJOIDC-232Resolved issue: JOIDC-232Henri Mikkonen
- Multiple resource parameters cause MessageDecodingExceptionJOIDC-231Resolved issue: JOIDC-231Henri Mikkonen
- Add flag to block additional audiences from initial access tokenJOIDC-230Resolved issue: JOIDC-230Henri Mikkonen
- Provide method for strict scope validationJOIDC-229Resolved issue: JOIDC-229Henri Mikkonen
- Exclude end-session flow from the IdP response header filter coverageJOIDC-228Resolved issue: JOIDC-228Henri Mikkonen
- OIDC RP-init Logout vm Uncaught runtime exceptionJOIDC-227Resolved issue: JOIDC-227Henri Mikkonen
- Autoconfigure CORS for public OIDC clientsJOIDC-226Henri Mikkonen
- Relocate and improve lookup functions for request message contentsJOIDC-225Resolved issue: JOIDC-225Henri Mikkonen
- Openid-scope with client credentials grant may cause wrong errorJOIDC-224Resolved issue: JOIDC-224Henri Mikkonen
- IDP Session (cookies) not created after OIDC Login in IDP Version 5.1.3JOIDC-223Resolved issue: JOIDC-223Henri Mikkonen
- Support for OpenID FederationJOIDC-222Henri Mikkonen
- Migrate to dedicated audit formatting stringsJOIDC-221Henri Mikkonen
- Outbound interceptor flows are not executed before error responsesJOIDC-220Resolved issue: JOIDC-220Henri Mikkonen
- Add ignoreScoping to OIDC.SSO propertiesJOIDC-219Resolved issue: JOIDC-219Scott Cantor
- Error handling for missing and invalid request objectsJOIDC-218Resolved issue: JOIDC-218Henri Mikkonen
- Support for OAuth2 JWT-Secured Authorization Request (JAR)JOIDC-217Resolved issue: JOIDC-217Henri Mikkonen
- Support for JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)JOIDC-216Henri Mikkonen
- Prefix form_post response parameter keys in Velocity contextJOIDC-215Resolved issue: JOIDC-215Henri Mikkonen
- Response type parameter handling in authorization endpointJOIDC-214Resolved issue: JOIDC-214Henri Mikkonen
- Make scope nullable in TokenClaimsSet and its subclassesJOIDC-213Resolved issue: JOIDC-213Henri Mikkonen
- Empty/missing scope in authorization request produces uncaught exceptionJOIDC-212Resolved issue: JOIDC-212Henri Mikkonen
- Provide method to customise response message contentsJOIDC-211Resolved issue: JOIDC-211Henri Mikkonen
- Refactor support for non-URI resource indicators for Nimbus v11JOIDC-210Resolved issue: JOIDC-210Henri Mikkonen
- upgrade json-smart 2.4.8JOIDC-209Resolved issue: JOIDC-209Henri Mikkonen
- Ignore scope in token endpoint with authorization code grantJOIDC-208Resolved issue: JOIDC-208Henri Mikkonen
- Need to add links to javadoc from profile config pagesJOIDC-207Scott Cantor
- Provide method to avoid Nimbus message parsing restrictionsJOIDC-206Resolved issue: JOIDC-206Henri Mikkonen
- Add link back to Nimbus and JOSE javadocsJOIDC-205Resolved issue: JOIDC-205Henri Mikkonen
- Support for OAuth2 Attestation-Based Client AuthenticationJOIDC-204Henri Mikkonen
- Support for OAuth 2.0 Device Authorization GrantJOIDC-203Henri Mikkonen
- Release 4.1.0JOIDC-202Resolved issue: JOIDC-202Henri Mikkonen
- Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)JOIDC-201Resolved issue: JOIDC-201Henri Mikkonen
- Support for OAuth2 Pushed Authorization Requests (PAR)JOIDC-200Resolved issue: JOIDC-200Henri Mikkonen
- UserInfo JWT access token issued by the implicit authorize flow is not signedJOIDC-199Resolved issue: JOIDC-199Henri Mikkonen
- Fix incorrect NonNull annotations in APIJOIDC-198Resolved issue: JOIDC-198Henri Mikkonen
- Allowed ResponseModes should be configurableJOIDC-197Resolved issue: JOIDC-197Henri Mikkonen
- Enhance metadata and unregistered client policy config optionsJOIDC-196Resolved issue: JOIDC-196Henri Mikkonen
- Suggest changing the support level for Versions 3.0.4JOIDC-195Henri Mikkonen
- Logging improvements for message tracingJOIDC-194Resolved issue: JOIDC-194Henri Mikkonen
- Flow cleanup to leverage ensureContext and of legacy classesJOIDC-193Resolved issue: JOIDC-193Scott Cantor
- Remove dashes from subject claim examplesJOIDC-192Resolved issue: JOIDC-192Scott Cantor
- Harmonise the use of identifier generation strategiesJOIDC-191Resolved issue: JOIDC-191Henri Mikkonen
50 of 238
RP metadata unnecessarily requires a value for response_types
Basics
Logistics
Basics
Logistics
Description
Environment
None
blocks
Henri Mikkonen
Details
Details
Assignee
Henri Mikkonen
Henri MikkonenReporter
Henri Mikkonen
Henri MikkonenComponents
Created May 2, 2025 at 12:00 PM
Updated May 2, 2025 at 12:19 PM
The RP/client metadata specified at dynamic client registration [1] defines
response_typesas optional. If omitted, the default value iscode. Same logic is also used in the OAuth2 equivalent [2], so we should not require any value to be set in the metadata.[1] https://openid.net/specs/openid-connect-registration-1_0.html
[2] https://datatracker.ietf.org/doc/html/rfc7591