Dynamic Registration requirement level for OP

Open
#216 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Stale

Research direction

Read section 5.2, OIDC Registration, and the linked dynamic registration reference first. Resolve whether Dynamic Client Registration is a MUST, SHOULD, or MAY for an OP, then update the specification's normative wording and verify that the rendered section is consistent.

Written by the indexing model from the issue text.

Description

This is one of the issues raised in a conversation with @dteleguin

5.2. OIDC Registration

For non-dereferencable identifiers, the Client MUST present a client_id value that has been registered with the OP via either OIDC dynamic or static registration. See also [OIDC-DYNAMIC-CLIENT-REGISTRATION].

When requesting Dynamic Client Registration, the Client MUST specify the scope in the metadata and include webid in its value (space-separated list).

The spec doesn't say clearly if the OIDC Provider MUST, SHOULD, or MAY support Dynamic Registration.

I don't think OP MUST provide DynReg and we should clarify it with explicit SHOULD or MAY.

As far as I recall, Keycloack would need to enable CORS on the Client Registration Endpoint to work with Solid-OIDC. Leaving DynReg optional should result in more fully conformant OPs.

Dominant language
Bikeshed
Stars
26
Forks
14
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from solid/solid-oidc

All issues in solid/solid-oidc

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.