{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"This is a profile defining the expression of OIDC and OAuth client capabilities and characteristics in SAML 2.0 Metadata, which is the native and preferred metadata format supported by the Shibboleth IdP software.","type":"text"}]},{"type":"paragraph","content":[{"text":"The XML namespace for the additional content used in this profile is ","type":"text"},{"text":"urn:mace:shibboleth:metadata:oidc:1.0","type":"text","marks":[{"type":"code"}]},{"text":", the schema for which can be found at ","type":"text"},{"text":"http://shibboleth.net/schema/oidc/saml-metadata-ext-oidcmd.xsd","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/schema/oidc/saml-metadata-ext-oidcmd.xsd"}}]}]},{"type":"paragraph","content":[{"text":"In comparison to the existing (JSON) format, all the same configuration options are available. See the ","type":"text"},{"text":"table","type":"text","marks":[{"type":"link","attrs":{"href":"#OAuthRPMetadataProfile-Mappings"}}]},{"text":" at the end for mappings between the JSON claims and the SAML metadata.","type":"text"}]},{"type":"paragraph","content":[{"text":"An entity advertises support for the OIDC protocol via an ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" that has the following characteristics:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MUST include ","type":"text"},{"text":"http://openid.net/specs/openid-connect-core-1_0.html","type":"text","marks":[{"type":"code"}]},{"text":" in the ","type":"text"},{"text":"protocolSupportEnumeration","type":"text","marks":[{"type":"code"}]},{"text":" attribute","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Contains one or more ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements that MUST have the following XML attributes:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Binding","type":"text","marks":[{"type":"code"}]},{"text":" attribute with a value of ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"https://tools.ietf.org/html/rfc6749#section-3.1.2 ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Location","type":"text","marks":[{"type":"code"}]},{"text":" attribute with a URL of a single redirection endpoint","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]}]}]}]},{"type":"paragraph","content":[{"text":"When needed, the trusted public keys and client secrets are configured via ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements. In addition to the existing public key ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" children (","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"), JSON Web Key sets are supported statically or via reference URI, using ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements (see the table in the end of this page).","type":"text"}]},{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element contains a base64-encoded JSON structure containing the set.","type":"text"}]},{"type":"paragraph","content":[{"text":"Client secrets can be configured statically in plaintext or via reference, using the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"An example representing an OIDC RP with client secret value in the metadata:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"OIDC metadata entry with client secret value","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n mockClientSecretValue\n \n \n urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public\n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"An example representing an OIDC RP with client secret value reference. The reference key (","type":"text"},{"text":"mockClientSecretKey","type":"text","marks":[{"type":"code"}]},{"text":") is exploited by client secret value resolvers, which are out of scope of this profile.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"OIDC metadata entry with client secret key reference","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n mockClientSecretKey\n \n \n urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:pairwise\n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"An example representing an OIDC RP with multiple public keys configured in the metadata. They're all taken into account and transformed into a JSON Web Key set, with ds:KeyName being used as a key identifier (kid).","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"OIDC metadata entry with multiple public keys","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n mockX509RSA\n \n \n MIIEQDCCAqigAwIBAgIVAIarXvdvyS47KJR7U40FlTufyD8vMA0GCSqGSIb3DQEB\n CwUAMCAxHjAcBgNVBAMMFWxvY2FsaG9zdC5sb2NhbGRvbWFpbjAeFw0xOTA2MTcx\n MTI5MTJaFw0zOTA2MTcxMTI5MTJaMCAxHjAcBgNVBAMMFWxvY2FsaG9zdC5sb2Nh\n bGRvbWFpbjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALXysGFnoBFh\n oasd5uMecp9OTBjvztntPUVmHfm4R3AcItEMEZEN/pETcX/wgKdo4qCBq4PrZITa\n T8Salgl0XL6qF1Wia3JNA7Hh/OaoQEUsbsHgsjLMKt6MJh8vIaE1o8loL7Ay4WmZ\n Cr3wc8ZS6CpMsv+qbxkyfl1h7MTydETnQhg/X83bj+BjJSh7QeFU0d0SWK1dN2/D\n nFoGOfuTfVqeDRIwMxKlR5G//8N202sLaG28NljaHhLn3jHXeiGpCQ+Q2X90dkFb\n EKb6sQ6SlDUAzm9MwLYjglDyOhXpUqOnvD67nggLb4Gn/4k+g5wtdfr7unOJYcHK\n w7JGnI8Gd0lJMd6B3SpkhUOWgKv/D6HIBArhqSEmXuTyy8FewyYuo1XkIw/Lu3bB\n 9qoBojM1tygoGlKi7R7e719J+DSkhyGbMyQ59leoN97iGGgqjUWS5mew8zSNviyz\n 4uGqvxmLWU9UTH1YhlARsBF1bMiMnwLz7dF74AaAkC4pN3BYzDMyHQIDAQABo3Ew\n bzAdBgNVHQ4EFgQUwKUd9D1Qymu2oBEVTscrAhP+sIUwTgYDVR0RBEcwRYIVbG9j\n YWxob3N0LmxvY2FsZG9tYWluhixodHRwczovL2xvY2FsaG9zdC5sb2NhbGRvbWFp\n bi9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAYEAEYqh54a+j5OuR1UB\n /AT9k2xXVwHiqQXAC/2un8O5BWAOeOq9+0gLJO5yaJp5c9GjPXRJmnDfGP9HFF6R\n CjngtRCm1gV/fpj97IRQS5oroaeTWPQ9ZD5+ogs5DNt6UZeJ2GqpfA5mOytNg3cM\n OP1B5QnA1apOaG4FHTegJR7WOIXkkAjEJUy6R+5Q6At7DdK/SRrP5onVPFv2HgGF\n E9v9iX/uQepDizS5F2oi6LZCl1/b38gxA8BFL7VZu53JQguaA7SrnP+dBOErT/yh\n Qcx3e9wE2ms8H1qISIdl3e7gvLi5jEyDWC9Agde6EjjvVVJAF7jR0puQ39mBfoxP\n moVdHJQmCt3V7Ew9tYZUpG3rjp4YNXOiM+QhtwhHWT94q9uJKUQ6JvbxgLNDs5KM\n 3PENx2C60TPFne9nRRIMVDavU4wwY7GdCgeo8PiZ5zxI0ZCkxh38ODePtKQrxJ7i\n E0J1BE2LIxa1T7KY0XKpsH0iI2dNfZfNpNp4v/HiDb4svYgq\n \n \n \n \n \n mockX509EC\n \n \n MIIBKDCBzgIJAOYlspXlaqguMAoGCCqGSM49BAMCMBwxCzAJBgNVBAYTAkZJMQ0w\n CwYDVQQDDAR0ZXN0MB4XDTE5MTEwMTA4Mjg0OVoXDTIwMTAzMTA4Mjg0OVowHDEL\n MAkGA1UEBhMCRkkxDTALBgNVBAMMBHRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMB\n BwNCAARCUOlFMtRj3MIbdCzXmoGz4giDwjzPoX4AxMehhlXmPOodQhLDdvDqx3KE\n hqadzIIsKHRQPDycscpHWpPbaQ2VMAoGCCqGSM49BAMCA0kAMEYCIQCVykSuUjlX\n j4lxI6YqgYVuuhL2rG4hIrXw/pCey7eF2gIhAOSSaS025lQWy09W4NlnO28OkHoI\n +Hbap7+DQlhbbr2d\n \n \n \n \n \n mockRSA\n \n \n \n AMP1p7GwPH64UPvBKD4DK0I6SDY7dtFPzL7L5qAIEJwIBBeDmLfVY/f9mLzDuDb19XzQxc6GEcjj\n K8qRe7JAD3CE1IXXD0hKSOJ7H+chWS84iv7UNukbHHBO1oaRgfHh7vbX7HnpYMoqKK75rfiQqD9e\n XOa2FLiH1QvnhLGKJcN+OKujetTgAhxE7ski9Gtfhhbt1qCEl7XtaUCLLexyrwWxx+NRxFgMU+nt\n IZQ+T8ii+JQSWnRh14PGc+K9o1dp+vjse62hFprVQhhcbAKAkWpbup77NvvuTZ2+AtUhOuNHrH2I\n X3jHeSWH7EzTGkPLGS6bFnYJQBqWv0POytfSyMM=\n AQAB\n \n \n \n \n \n \n mockJwkId\n \n ewogICJrdHkiOiAiUlNBIiwKICAiZSI6ICJBUUFCIiwKICAia2lkIjogIm1vY2siLAogICJhbGci\n OiAiUlMyNTYiLAogICJuIjogInBKcHRScnpyRlhEUnBaWkdpRmc1eW9KeVRPMlphUENSNEcwbjEx\n aUVSclBTdlVYX202Qmdvak5qVEZISk1pa19pbGhtVzY0Q3JLdGlMdklRTFF6VWV5RXdDZHdYZVB3\n UVpNeEV4VDJPV2thQy1DV0ZJNHR4X2VFWGRkUGtja1NMRERhMEVQd3dzWktQUFhoRTNWNTBfZ3pW\n VDJZQVRvRE9fMmoyeGpWcHFzU0dFc0xpYjZqLW52dFpVVV9CMHNHeUppR1ZzMkpUTmhCTVNrT2tR\n Zks2NkNCcW1sbzBuUE5NYVIxbWl2dG5JUG1aNnJKVHcwUDVZZ0dFS1hmZjBsa25Ib25ZVmRsVktw\n c0Q4VW5hY0JzdFlyeUhsM0NQR2Uyc3RmR2ExZ3N6NEdIVGVfRnlWVk04UlNoQ2dYVVo3MTdoenpf\n ekdQaVhDQkw0ZktEek5ZUXpIUSIKfQo=\n \n \n urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public\n \n \n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Mappings"},"legacyAnchorId":{"value":"OAuthRPMetadataProfile-Mappings"}},"macroMetadata":{"macroId":{"value":"65799169-f386-4cc8-b212-29c36736c0fe"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"10a73771-8434-4fc9-855d-f8668e87171c"}},{"text":"Mappings between the JSON claims and SAML metadata elements","type":"text"}]},{"type":"paragraph","content":[{"text":"The definitions for the JSON claims can be found from the following specifications:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OAuth 2.0 Dynamic Client Registration protocol: ","type":"text"},{"text":"https://tools.ietf.org/html/rfc7591","type":"text","marks":[{"type":"link","attrs":{"href":"https://tools.ietf.org/html/rfc7591"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OIDC Dynamic Client Registration: ","type":"text"},{"text":"https://openid.net/specs/openid-connect-registration-1_0.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-registration-1_0.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OIDC session management spec: ","type":"text"},{"text":"https://openid.net/specs/openid-connect-session-1_0.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-session-1_0.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OIDC federation spec (draft): ","type":"text"},{"text":"https://openid.net/specs/openid-connect-federation-1_0.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-federation-1_0.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OIDC Front-Channel logout 1.0 spec: ","type":"text"},{"text":"https://openid.net/specs/openid-connect-frontchannel-1_0.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-frontchannel-1_0.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OIDC Back-Channel logout 1.0 spec: ","type":"text"},{"text":"https://openid.net/specs/openid-connect-backchannel-1_0.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-backchannel-1_0.html"}}]}]}]}]},{"type":"paragraph","content":[{"text":"XML namespaces:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"default (no prefix): ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:metadata","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"saml:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:assertion","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"mdui","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"urn:oasis:names:tc:SAML:metadata:ui","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ds","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"http://www.w3.org/2000/09/xmldsig#","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"oidcmd","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"urn:mace:shibboleth:metadata:oidc:1.0","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"5600d60f-6eed-4d39-9fdd-30c58e8879c9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"JSON claim","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"SAML metadata location","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Notes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"client_id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/@entityID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"client_secret","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/","type":"text"},{"text":"ds:KeyDescriptor/","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"ds:KeyInfo/oidcmd:ClientSecret","type":"text"}]},{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/","type":"text"},{"text":"ds:KeyDescriptor/","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"ds:KeyInfo/oidcmd:ClientSecretKeyReference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Only one value per entity","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"redirect_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/AssertionConsumerService","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Binding: ","type":"text"}]},{"type":"paragraph","content":[{"text":"https://tools.ietf.org/html/rfc6749#section-3.1.2","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"token_endpoint_auth_method","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"application_type","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"client_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"software_id","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"software_version","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"sector_identifier_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"id_token_signed_response_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"id_token_encrypted_response_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"id_token_encrypted_response_enc","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"userinfo_signed_response_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"userinfo_encrypted_response_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"userinfo_encrypted_response_enc","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"request_object_signing_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"request_object_encryption_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"request_object_encryption_enc","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"token_endpoint_auth_signing_alg","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"default_max_age","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"require_auth_time","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"initiate_login_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"frontchannel_logout_session_required ","type":"text"},{"text":"v2.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"backchannel_logout_session_required ","type":"text"},{"text":"v2.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"Like-named XML Attributes defined on:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"These are single-valued claims that map directly into XML Attributes in a metadata extension element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"grant_types","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"response_types","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"scopes","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"Like-named XML Attributes defined on:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"These are multiple-valued claims that map directly into XML Attributes in a metadata extension element. Multiple values are supplied using a space-delimited list.","type":"text"}]},{"type":"paragraph","content":[{"text":"NOTE: Since OP 3.2, use '+' sign to supply a response type value containing a space. For instance, the value \"code code+id_token+token\" in XML is translated into two OIDC response types: \"code\" and \"code id_token token\".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"client_name","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/mdui:UIInfo/mdui:DisplayName","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"logo_uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/mdui:UIInfo/mdui:Logo","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"contacts","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/ContactPerson/EmailAddress","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"organization_name","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/Organization/OrganizationName","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"tos_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/mdui:UIInfo/mdui:InformationURL","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"policy_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/mdui:UIInfo/mdui:PrivacyStatementURL","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"jwks_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/ds:KeyDescriptor/ds:KeyInfo/oidcmd:JwksUri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"jwks","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/ds:KeyDescriptor/ds:KeyInfo/oidcmd:JwksData","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"The value is Base64-encoded JSON string.","type":"text"}]},{"type":"paragraph","content":[{"text":"The JSON may be a single ","type":"text"},{"text":"JWK","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.rfc-editor.org/info/rfc7517"}}]},{"text":" or a JSON array of JWKs.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"subject_type","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/NameIDFormat","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"One of:","type":"text"},{"type":"hardBreak"},{"text":"urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:pairwise","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"default_acr_values","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions/oidcmd:default_acr_value","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Each value is defined in an extension element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"request_uris","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions/oidcmd:request_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Each value is defined in an extension element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"post_logout_redirect_uris","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions/oidcmd:post_logout_redirect_uri","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Each value is defined in an extension element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"audience ","type":"text"},{"text":"1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/Extensions/oidcmd:OAuthRPExtensions/saml:Audience","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Each value is defined in an extension element (the element itself is a standard SAML element imported from the Assertion schema).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"frontchannel_logout_uri ","type":"text"},{"text":"v2.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/SingleLogoutService","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Binding: ","type":"text"}]},{"type":"paragraph","content":[{"text":"https://openid.net/specs/openid-connect-frontchannel-1_0.html","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[314.0]},"content":[{"type":"paragraph","content":[{"text":"backchannel_logout_uri ","type":"text"},{"text":"v2.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[400.0]},"content":[{"type":"paragraph","content":[{"text":"EntityDescriptor/SPSSODescriptor/SingleLogoutService","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[571.0]},"content":[{"type":"paragraph","content":[{"text":"Binding:","type":"text"}]},{"type":"paragraph","content":[{"text":"https://openid.net/specs/openid-connect-backchannel-1_0.html","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"text":" The “audience” claim is not drawn from any standard, but an extension supported by Shibboleth to control/validate the “resource” parameter used in various OAuth protocol extensions, particularly in the client_credentials grant flow.","type":"text"}]},{"type":"paragraph","content":[{"text":"v2.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"text":" The support was added in ","type":"text"},{"text":"net.shibboleth.oidc.common","type":"text","marks":[{"type":"code"}]},{"text":" v2.2.0","type":"text"}]}],"version":1}

Browser not supported