From fcbb16c651dbb775ffe673ccab9dadb435a5844e Mon Sep 17 00:00:00 2001
From: William Denniss <wdenniss@google.com>
Date: Fri, 29 Mar 2019 13:06:05 -0700
Subject: [PATCH] Support RFC 8414 better by allowing for its OPTIONAL metadata

---
 Source/OIDServiceDiscovery.h | 10 ++++++----
 Source/OIDServiceDiscovery.m | 22 ++++++++++++++--------
 2 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/Source/OIDServiceDiscovery.h b/Source/OIDServiceDiscovery.h
index 982d71005..e8caa9ace 100644
--- a/Source/OIDServiceDiscovery.h
+++ b/Source/OIDServiceDiscovery.h
@@ -20,8 +20,10 @@
 
 NS_ASSUME_NONNULL_BEGIN
 
-/*! @brief Represents an OpenID Connect 1.0 Discovery Document
+/*! @brief Represents an OpenID Connect 1.0 Discovery or OAuth 2.0 Authorization Server Metadata
+        Document.
     @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+    @see https://tools.ietf.org/html/rfc8414
  */
 @interface OIDServiceDiscovery : NSObject <NSCopying, NSSecureCoding>
 
@@ -58,7 +60,7 @@ NS_ASSUME_NONNULL_BEGIN
  */
 @property(nonatomic, readonly, nullable) NSURL *userinfoEndpoint;
 
-/*! @brief REQUIRED. URL of the OP's JSON Web Key Set document. This contains the signing key(s) the
+/*! @brief REQUIRED for OpenID Connect 2.0, OPTIONAL for RFC 8414. URL of the OP's JSON Web Key Set document. This contains the signing key(s) the
         RP uses to validate signatures from the OP. The JWK Set MAY also contain the Server's
         encryption key(s), which are used by RPs to encrypt requests to the Server. When both
         signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED
@@ -116,13 +118,13 @@ NS_ASSUME_NONNULL_BEGIN
  */
 @property(nonatomic, readonly, nullable) NSArray<NSString *> *acrValuesSupported;
 
-/*! @brief REQUIRED. JSON array containing a list of the Subject Identifier types that this OP
+/*! @brief REQUIRED for OpenID Connect 2.0, otherwise OPTIONAL. JSON array containing a list of the Subject Identifier types that this OP
         supports. Valid types include @c pairwise and @c public.
     @remarks subject_types_supported
  */
 @property(nonatomic, readonly) NSArray<NSString *> *subjectTypesSupported;
 
-/*! @brief REQUIRED. JSON array containing a list of the JWS signing algorithms (@c alg values)
+/*! @brief REQUIRED for OpenID Connect 2.0, otherwise OPTIONAL. JSON array containing a list of the JWS signing algorithms (@c alg values)
         supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm @c RS256
         MUST be included. The value @c none MAY be supported, but MUST NOT be used unless the
         Response Type used returns no ID Token from the Authorization Endpoint (such as when using
diff --git a/Source/OIDServiceDiscovery.m b/Source/OIDServiceDiscovery.m
index ca9628ef1..3b111a570 100644
--- a/Source/OIDServiceDiscovery.m
+++ b/Source/OIDServiceDiscovery.m
@@ -121,14 +121,15 @@ + (BOOL)dictionaryHasRequiredFields:(NSDictionary<NSString *, id> *)dictionary
   static NSString *const kMissingFieldErrorText = @"Missing field: %@";
   static NSString *const kInvalidURLFieldErrorText = @"Invalid URL: %@";
 
+  // Required fields for AppAuth are the intersection of
+  // REQUIRED fields in OpenID Connect Discovery 1.0 and RFC 8414
+  // See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata and
+  // https://tools.ietf.org/html/rfc8414#section-2
   NSArray *requiredFields = @[
     kIssuerKey,
     kAuthorizationEndpointKey,
     kTokenEndpointKey,
-    kJWKSURLKey,
     kResponseTypesSupportedKey,
-    kSubjectTypesSupportedKey,
-    kIDTokenSigningAlgorithmValuesSupportedKey
   ];
 
   for (NSString *field in requiredFields) {
@@ -143,15 +144,20 @@ + (BOOL)dictionaryHasRequiredFields:(NSDictionary<NSString *, id> *)dictionary
     }
   }
 
-  // Check required URL fields are valid URLs.
-  NSArray *requiredURLFields = @[
+  // Check URL fields (if present) are valid URLs.
+  NSArray *urlFields = @[
     kIssuerKey,
+    kAuthorizationEndpointKey,
     kTokenEndpointKey,
-    kJWKSURLKey
+    kUserinfoEndpointKey,
+    kRegistrationEndpointKey,
+    kJWKSURLKey,
+    kOPTosURIKey,
+    kOPPolicyURIKey
   ];
 
-  for (NSString *field in requiredURLFields) {
-    if (![NSURL URLWithString:dictionary[field]]) {
+  for (NSString *field in urlFields) {
+    if (dictionary[field] && ![NSURL URLWithString:dictionary[field]]) {
       if (error) {
         NSString *errorText = [NSString stringWithFormat:kInvalidURLFieldErrorText, field];
         *error = [OIDErrorUtilities errorWithCode:OIDErrorCodeInvalidDiscoveryDocument