Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Claim redirect_uri on token request #209

Open
wants to merge 9 commits into
base: versione-corrente
Choose a base branch
from
Open

Claim redirect_uri on token request #209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
04244a4
Update token_endpoint.rst
damikael Mar 25, 2024
ea71d9a
Update token_endpoint.rst
damikael Mar 25, 2024
2141231
Update token_endpoint.rst
damikael Mar 26, 2024
4843b93
Update token_endpoint.rst
damikael Mar 26, 2024
981c8dc
Update docs/en/token_endpoint.rst
damikael Mar 26, 2024
55e4724
Update docs/en/token_endpoint.rst
damikael Mar 26, 2024
af3a230
Update docs/en/token_endpoint.rst
damikael Mar 26, 2024
c591cee
Update docs/it/token_endpoint.rst
damikael Mar 26, 2024
2d6497e
Update docs/it/token_endpoint.rst
damikael Mar 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions docs/en/token_endpoint.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@ The claims that MUST be included in the *Token Request* are given below.
client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
code=usDwMnEzJPpG5oaV8x3j&
code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2&
grant_type=authorization_code
grant_type=authorization_code&
redirect_uri=https%3A%2F%2Frp.spid.agid.gov.it%2Fredirect


.. seealso::
Expand All @@ -63,7 +64,8 @@ The claims that MUST be included in the *Token Request* are given below.
ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
grant_type=refresh_token&
refresh_token=8xLOxBtZp8
refresh_token=8xLOxBtZp8&
redirect_uri=https%3A%2F%2Frp.spid.agid.gov.it%2Fredirect


.. list-table::
Expand Down Expand Up @@ -112,7 +114,9 @@ The claims that MUST be included in the *Token Request* are given below.
* - **refresh_token**
- Required only if **grant_type** is **refresh_token**.
- |spid-icon| |cieid-icon|

* - **redirect_uri**
- Required. It MUST be one of the values declared into the claim **redirect_uris** in the RP metadata and it MUST match the value of the claim **redirect_uri** included in the previous authorization request.
- |spid-icon| |cieid-icon|
Comment on lines +117 to +119
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any normative section within OIDC Core and iGov Profile requiring redirect_uri as a mandatory claim in the token request. Moreover, I see no security issues if this claim is omitted. I suggest considering it as OPTIONAL saying that if it is present the OP MUST check that it is the same value provided in the authorization request and the same value included in the RP Metadata.


Response
++++++++
Expand Down
10 changes: 7 additions & 3 deletions docs/it/token_endpoint.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@ Di seguito i claim che DEVONO essere inseriti nella *Token Request*.
client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
code=usDwMnEzJPpG5oaV8x3j&
code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2&
grant_type=authorization_code
grant_type=authorization_code&
redirect_uri=https%3A%2F%2Frp.spid.agid.gov.it%2Fredirect

.. seealso::

Expand All @@ -63,7 +64,8 @@ Di seguito i claim che DEVONO essere inseriti nella *Token Request*.
ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
grant_type=refresh_token&
refresh_token=8xLOxBtZp8
refresh_token=8xLOxBtZp8&
redirect_uri=https://rp.spid.agid.gov.it/redirect


.. list-table::
Expand Down Expand Up @@ -112,7 +114,9 @@ Di seguito i claim che DEVONO essere inseriti nella *Token Request*.
* - **refresh_token**
- Obbligatorio solo se **grant_type** è **refresh_token**
- |spid-icon| |cieid-icon|

* - **redirect_uri**
- Obbligatorio. DEVE essere uno dei valori dichiarati all'interno del claim **redirect_uris** nel metadata del RP e DEVE essere identico al valore del claim **redirect_uri** incluso nella authorization request.
- |spid-icon| |cieid-icon|

Response
++++++++
Expand Down
Loading