detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance tests

Open
#863 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active

Research direction

Start by locating the conformance test that fetches either .well-known/openid-configuration or .well-known/oauth-authorization-server, and review the related decision in issue #862. Done means checking the alternate location when available, warning when both documents differ, and ignoring an unavailable alternate endpoint.

Written by the indexing model from the issue text.

Description

component: Certification component: FAPI2: Advanced Authorization

Vaguely related to https://github.com/openid/fapi/issues/862

It's suggest that the conformance test could fetch the version it's not currently using (so if it's using openid-configuration, also fetch oauth-authorization-server) and raise a warning if the contents are different, suggesting that (as the keys in the document trace back to the same IANA registry) the contents should be consistent and that interoperability / race conditions might occur if they differ.

If the fetch of the other location fails (e.g. 404) that would be ignored (unless #862 comes to a different conclusion).

An opinion from the working group on whether this is a good idea to check would be appreciated.

Dominant language
HTML
Stars
4
Forks
3
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openid/fapi

All issues in openid/fapi

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.