Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Support for OAuth2 JWT-Secured Authorization Request (JAR)

Description

Currently the OP’s request object handling follows the OIDC core specification. The OAuth2 JAR specifies how the request objects should be handled with OAuth2 authorization requests.

Environment

None

Activity

Henri MikkonenJune 19, 2024 at 12:02 PM

  • Changed authorization/authentication request lookup functions to exploit a predicate for only using request object values

    • By default the predicate returns true if the request is not OIDC authentication request and contains request object

  • Updated authorize and PAR flows to enforce request object signing whenever non-OIDC authorization request contains request object

  • Improved flow tests

Completed

Details

Assignee

Reporter

Components

Fix versions

Created June 17, 2024 at 12:34 PM
Updated October 23, 2024 at 7:33 AM
Resolved October 23, 2024 at 7:33 AM