{"type":"doc","content":[{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":2}}],"content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"conf/oidc.properties","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" Native Spring, Spring Properties","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"5cc5fa31-e404-4a93-ba8d-b5dd24e7033d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"f0d9bb35-0072-46c1-bfbc-37dbf5eca078"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"There are two general ways to register and manage OIDC \"clients\" (RPs), using out of band ","type":"text"},{"text":"metadata","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879133"}}]},{"text":" and dynamically. Dynamic registration is described by the ","type":"text"},{"text":"OpenID Connect Dynamic Client Registration 1.0","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-registration-1_0.html"}}]},{"text":" specification. Support for this profile is located at ","type":"text"},{"text":"/idp/profile/oidc/register","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Activation and Use","type":"text"}]},{"type":"paragraph","content":[{"text":"Support for dynamic registration is enabled by enabling a profile configuration bean called (or inherited from) \"OIDC.Registration\". Prior to V3.1, the only way to enable this profile is via the ","type":"text"},{"text":"shibboleth.UnverifiedRelyingParty","type":"text","marks":[{"type":"strong"}]},{"text":" bean (see ","type":"text"},{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://RelyingPartyConfiguration@idp"}}]},{"text":") since the RP by definition isn't verified at the time of initial registration.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n \n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"With V3.1, the endpoint is now an OAuth-protected resource. When configured for unverified use, no token is required; otherwise clients must present an access token to use the endpoint and their registration request can be influenced by metadata policy attached to the profile configuration and/or in the access token itself.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issuing Registration Access Tokens","type":"text"}]},{"type":"paragraph","content":[{"text":"To generate an access token accepted by this endpoint (something not defined by any standards), an ","type":"text"},{"text":"administrative","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631720"}}]},{"text":" flow implementing a simple REST service exists at ","type":"text"},{"text":"/idp/profile/admin/oidc/issue-registration-access-token","type":"text","marks":[{"type":"code"}]},{"text":". A command line script to make simple requests to this endpoint is also installed to ","type":"text"},{"text":"bin","type":"text","marks":[{"type":"strong"}]},{"text":". This endpoint can be tailored to address two different scenarios:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OP operators generating tokens on behalf of clients (very loose control over populating tokens)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client developers/operators authenticating to the endpoint to request their own tokens (generally much more access control required)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"To address these two “extreme” ends of the spectrum, the operation of the endpoint is configurable (as all administrative features can be) to support user authentication, resolve attributes, and apply the resulting request context to a number of different ","type":"text"},{"text":"access control","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631516"}}]},{"text":" policy beans used to control whether to honor a particular request.","type":"text"}]},{"type":"paragraph","content":[{"text":"The REST endpoint supports the following parameters. All are optional, but at least one of policyId or policyLocation MUST be supplied.","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"5edad3b1-88c3-4cc7-a643-60dcebe236aa"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"lifetime","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Token lifetime (expressed as an ISO Duration, e.g., PT2H), bounded by a maximum/default set by ","type":"text"},{"text":"idp.oidc.admin.registration.defaultTokenLifetime","type":"text","marks":[{"type":"strong"}]},{"text":" property","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"policyLocation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Locates an on-server resource containing a ","type":"text"},{"text":"metadata policy","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2948497410"}}]},{"text":" to embed in the token to be enforced on use. This is generally used by an OP operator to identify pre-defined policy documents on the server. This is how policy is added to the token by value.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"policyId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Identifies a metadata policy by means of an identifier that maps back to a matching RelyingParty override. The match is based on the ","type":"text"},{"text":"id","type":"text","marks":[{"type":"code"}]},{"text":" XML attribute in the override element. This is more likely to be used by clients/developers to identify policy by reference, and the policy is looked up and enforced upon use of the token.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"clientId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Optionally specifies the OAuth/OIDC client_id to register with. When absent, registering with the token will (as in the absence of a token) randomly generate an opaque and largely unwieldy client_id that isn’t meant to be used in OP policy. Specifying the client_id ahead of time allows registrations to be “reserved” for named clients that get “filled in” by clients when ready to proceed.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"replacement","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1113.0]},"content":[{"type":"paragraph","content":[{"text":"Used only if “clientId” is also supplied. If “true”, the token can be used to register a client’s metadata multiple times within the life of the token, allowing update/replacement of client metadata as needed.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"To control endpoint use, there are 4 independent ","type":"text"},{"text":"access control","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631516"}}]},{"text":" policies applied to allow a token to be issued (these are the traditional IdP access policies, not the metadata policies referred to above). One is a front-door policy applying to any request, and three are specific to use of the “policyLocation”, “policyId”, and “clientId” parameters (the policies are applied only if the parameter exists). Properties (see below) are typically used to define which named policies to use.","type":"text"}]},{"type":"expand","attrs":{"title":"Administrative Flow Properties"},"content":[{"type":"table","attrs":{"layout":"default","localId":"aabd8b26-d8d9-4b48-8b08-a42d4f3fb0f7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"Name / Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.logging","type":"text"}]},{"type":"paragraph","content":[{"text":"IssueRegistrationAccessToken","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Audit logging label for this profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.nonBrowserSupported","type":"text"}]},{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Enables support for non-browser-based authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.authenticated","type":"text"}]},{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to enable user authentication for requests","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.resolveAttributes","type":"text"}]},{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to resolve attributes (if authentication is enabled)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.defaultTokenLifetime","type":"text"}]},{"type":"paragraph","content":[{"text":"PT1D","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Default access token lifetime if not specified","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.accessPolicy","type":"text"}]},{"type":"paragraph","content":[{"text":"AccessByIPAddress","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy to apply to all requests","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.policyLocationPolicy","type":"text"}]},{"type":"paragraph","content":[{"text":"AccessByAdmin","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/browse/JOIDC-174"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy to apply to requests specifying a policyLocation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.policyIdPolicy","type":"text"}]},{"type":"paragraph","content":[{"text":"AccessByAdmin","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy to apply to requests specifying a policyId","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.clientIdPolicy","type":"text"}]},{"type":"paragraph","content":[{"text":"AccessByAdmin","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy to apply to requests specifying a clientId","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[245.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.registration.lookup.policy","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[405.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of type Function>, used to locate metadata policy based on the policyLocation parameter. Defaults to a caching resolver locating server resources to load based on policyLocation parameter.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Storage","type":"text"}]},{"type":"paragraph","content":[{"text":"The dynamic client registration implementation relies on a ","type":"text"},{"text":"StorageService","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/IDP4/StorageConfiguration"}}]},{"text":" for storing the dynamically registered client information. The in-memory and ","type":"text"},{"text":"JPA","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/IDP4/StorageConfiguration#JPAStorageService"}}]},{"text":" options have been tested. Expired client information is automatically pruned.","type":"text"}]},{"type":"paragraph","content":[{"text":"Obviously the simple in-memory service is only sufficient for testing, and the only real option designed for durable persistence is the ","type":"text"},{"text":"JPA","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/IDP4/StorageConfiguration#JPAStorageService"}}]},{"text":" variant using a database.","type":"text"}]},{"type":"paragraph","content":[{"text":"The desired storage service bean can be set with the ","type":"text"},{"text":"idp.oidc.dynreg.StorageService","type":"text","marks":[{"type":"strong"}]},{"text":" property in ","type":"text"},{"text":"conf/oidc.properties","type":"text","marks":[{"type":"em"}]},{"text":". Also note that the deployer must configure a ","type":"text"},{"text":"StorageServiceClientInformationResolver","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879144"}}]},{"text":" exploiting that same service to allow the information to be accessed when requests are handled.","type":"text"}]},{"type":"paragraph","content":[{"text":"There is also a hook in V3.1+ for completely substituting a different management implementation by defining ","type":"text"},{"text":"idp.oidc.dynreg.clientInformationManager","type":"text","marks":[{"type":"strong"}]},{"text":" to the name of such a bean, though this would also entail other customizations, such as to the resolution process.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Managing Registrations","type":"text"}]},{"type":"paragraph","content":[{"text":"V3.1 adds an additional ","type":"text"},{"text":"administrative","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631720"}}]},{"text":" flow that can be used by operations staff to query and delete registrations. A command line script is provided for basic use, but the REST endpoint lives at ","type":"text"},{"text":"/idp/profile/admin/oidc/clients","type":"text","marks":[{"type":"code"}]},{"text":" and requires a single query string parameter, ","type":"text"},{"text":"client_id","type":"text","marks":[{"type":"code"}]},{"text":". The HTTP method can be changed to DELETE to perform a removal operation, while the default (GET) will query the service for existing client metadata.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this flow is strictly usable for access to OIDC “native” client metadata, not SAML metadata.","type":"text"}]},{"type":"expand","attrs":{"title":"Administrative Flow Properties"},"content":[{"type":"table","attrs":{"layout":"default","localId":"b5a74691-c77c-46ec-bceb-ffd6693afc04"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Name / Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.clients.logging","type":"text"}]},{"type":"paragraph","content":[{"text":"ClientManagement","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Audit logging label for this profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.clients.nonBrowserSupported","type":"text"}]},{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Enables support for non-browser-based authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.clients.authenticated","type":"text"}]},{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to enable user authentication for requests","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.clients.resolveAttributes","type":"text"}]},{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to resolve attributes (if authentication is enabled)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.admin.clients.accessPolicy","type":"text"}]},{"type":"paragraph","content":[{"text":"AccessByIPAddress","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[443.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy to apply to requests","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Profile Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"Virtually all the configuration options below can be set via two different properties: a static property that explicitly sets the value to use and a lookup strategy or predicate property that takes a ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" or ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":" and returns the value to use. The dynamic property is generally named \"propertyNamePredicate\" or \"propertyNameLookupStrategy\" for Boolean- and non-Boolean-valued properties respectively.","type":"text"}]},{"type":"paragraph","content":[{"text":"Most of these options are constraints on the values that can be registered, rather than actually controlling the behavior of the registration profile itself.","type":"text"}]},{"type":"expand","attrs":{"title":"Common"},"marks":[{"type":"breakout","attrs":{"mode":"wide"}}],"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"include","parameters":{"macroParams":{"":{"value":"OPProfileConfiguration-Common"}},"macroMetadata":{"macroId":{"value":"b8c88ce0fc41a733e1978b7b59f4770c341085d530f54f7b4fbae7756840bfcb"},"schemaVersion":{"value":"1"},"title":"Include Page"}},"localId":"3dae20bd-20bb-4a23-a21d-8c689bec7456"}}]},{"type":"expand","attrs":{"title":"Profile-Specific"},"content":[{"type":"paragraph","content":[{"text":"Options specific to the OIDC Dynamic Registration Profile:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"509782c5-a34d-4292-9d0c-dd3c84e66a94"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[147.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[65.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[334.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[147.0]},"content":[{"type":"paragraph","content":[{"text":"registrationValidityPeriod","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[104.0]},"content":[{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[65.0]},"content":[{"type":"paragraph","content":[{"text":"PT24H","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[334.0]},"content":[{"type":"paragraph","content":[{"text":"Registration lifetime","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"This setting is globally adjustable via the ","type":"text"},{"text":"idp.oidc.dynreg.defaultRegistrationValidity","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Flow Types"},"content":[{"type":"paragraph","content":[{"text":"These settings are used to control the allowable response_types that clients may register.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"include","parameters":{"macroParams":{"":{"value":"OPProfileConfiguration-FlowTypes"}},"macroMetadata":{"macroId":{"value":"a7aaf3ba-79ba-4492-a805-90963330c961"},"schemaVersion":{"value":"1"},"title":"Include Page"}},"localId":"4d07bbaa-e6ad-4b97-83f9-13de46ea3a10"}}]},{"type":"expand","attrs":{"title":"Client Authentication"},"content":[{"type":"paragraph","content":[{"text":"These settings are used to control the allowable token_endpoint_auth_method that clients may register.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"include","parameters":{"macroParams":{"":{"value":"OPProfileConfiguration-ClientAuthentication"}},"macroMetadata":{"macroId":{"value":"8a0a3e61-411f-4449-9beb-5968cab2af54"},"schemaVersion":{"value":"1"},"title":"Include Page"}},"localId":"a3912ea6-546c-4ed1-b5db-542292a11833"}},{"type":"paragraph","content":[{"text":"For convenience, this is also controllable globally via the ","type":"text"},{"text":"idp.oidc.dynreg.tokenEndpointAuthMethods","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Profile-Specific"},"content":[{"type":"paragraph","content":[{"text":"Options specific to this profile are:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"4b9a28c3-1997-43c5-9533-83f0b1e65254"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[112.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[182.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[356.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[112.0]},"content":[{"type":"paragraph","content":[{"text":"metadataPolicy ","type":"text"},{"text":"3.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[182.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[356.0]},"content":[{"type":"paragraph","content":[{"text":"Metadata policy","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2948497410"}}]},{"text":" constraining the content of the client metadata that may be registered (each claim is a map key, each policy a map value).","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Supported Client Metadata","type":"text"}]},{"type":"paragraph","content":[{"text":"The following ","type":"text"},{"text":"standard client metadata","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata"}}]},{"text":" fields are currently supported:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"b79589ae-621f-42a5-b3bf-1c3e139d677e"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph","content":[{"text":"Req?","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph","content":[{"text":"Notes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"redirect_uris","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"Y","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"response_types","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph","content":[{"text":"\"code\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to \"code\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"grant_types","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph","content":[{"text":"One of \"authorization_code\", \"implicit\", and \"refresh_token\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"application_type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"contacts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"subject_type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph","content":[{"text":"Default can be set by ","type":"text"},{"text":"idp.oidc.dynreg.defaultSubjectType","type":"text","marks":[{"type":"strong"}]},{"text":" property","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"jwks / jwks_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"token_endpoint_auth_method","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"logo_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"policy_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[292.0]},"content":[{"type":"paragraph","content":[{"text":"tos_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[61.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[76.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[734.0]},"content":[{"type":"paragraph"}]}]}]},{"type":"paragraph","content":[{"text":"In addition to the standard fields, the following is supported:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"scope","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If present, all the requested scopes are added to the stored client metadata. If not present, then the default scope set is stored. The default scope (space-separated list of values, e.g. \"openid info\") can be configured with the ","type":"text"},{"text":"idp.oidc.dynreg.defaultScope","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"All the other (standard or not) fields in the request message are currently ignored. The response message contains all the fields that were stored by the OP during the registration process.","type":"text"}]},{"type":"paragraph"}],"version":1}