Skip to content

Support RFC 8414 better by allowing for its OPTIONAL metadata #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WilliamDenniss wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Support RFC 8414 better by allowing for its OPTIONAL metadata #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions Source/OIDServiceDiscovery.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,10 @@

NS_ASSUME_NONNULL_BEGIN

/*! @brief Represents an OpenID Connect 1.0 Discovery Document
/*! @brief Represents an OpenID Connect 1.0 Discovery or OAuth 2.0 Authorization Server Metadata
Document.
@see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
@see https://tools.ietf.org/html/rfc8414
*/
@interface OIDServiceDiscovery : NSObject <NSCopying, NSSecureCoding>

Expand Down Expand Up @@ -58,7 +60,7 @@ NS_ASSUME_NONNULL_BEGIN
*/
@property(nonatomic, readonly, nullable) NSURL *userinfoEndpoint;

/*! @brief REQUIRED. URL of the OP's JSON Web Key Set document. This contains the signing key(s) the
/*! @brief REQUIRED for OpenID Connect 2.0, OPTIONAL for RFC 8414. URL of the OP's JSON Web Key Set document. This contains the signing key(s) the
RP uses to validate signatures from the OP. The JWK Set MAY also contain the Server's
encryption key(s), which are used by RPs to encrypt requests to the Server. When both
signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED
Expand Down Expand Up @@ -116,13 +118,13 @@ NS_ASSUME_NONNULL_BEGIN
*/
@property(nonatomic, readonly, nullable) NSArray<NSString *> *acrValuesSupported;

/*! @brief REQUIRED. JSON array containing a list of the Subject Identifier types that this OP
/*! @brief REQUIRED for OpenID Connect 2.0, otherwise OPTIONAL. JSON array containing a list of the Subject Identifier types that this OP
supports. Valid types include @c pairwise and @c public.
@remarks subject_types_supported
*/
@property(nonatomic, readonly) NSArray<NSString *> *subjectTypesSupported;

/*! @brief REQUIRED. JSON array containing a list of the JWS signing algorithms (@c alg values)
/*! @brief REQUIRED for OpenID Connect 2.0, otherwise OPTIONAL. JSON array containing a list of the JWS signing algorithms (@c alg values)
supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm @c RS256
MUST be included. The value @c none MAY be supported, but MUST NOT be used unless the
Response Type used returns no ID Token from the Authorization Endpoint (such as when using
Expand Down
22 changes: 14 additions & 8 deletions Source/OIDServiceDiscovery.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,14 +121,15 @@ + (BOOL)dictionaryHasRequiredFields:(NSDictionary<NSString *, id> *)dictionary
static NSString *const kMissingFieldErrorText = @"Missing field: %@";
static NSString *const kInvalidURLFieldErrorText = @"Invalid URL: %@";

// Required fields for AppAuth are the intersection of
// REQUIRED fields in OpenID Connect Discovery 1.0 and RFC 8414
// See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata and
// https://tools.ietf.org/html/rfc8414#section-2
NSArray *requiredFields = @[
kIssuerKey,
kAuthorizationEndpointKey,
kTokenEndpointKey,
kJWKSURLKey,
kResponseTypesSupportedKey,
kSubjectTypesSupportedKey,
kIDTokenSigningAlgorithmValuesSupportedKey
];

for (NSString *field in requiredFields) {
Expand All @@ -143,15 +144,20 @@ + (BOOL)dictionaryHasRequiredFields:(NSDictionary<NSString *, id> *)dictionary
}
}

// Check required URL fields are valid URLs.
NSArray *requiredURLFields = @[
// Check URL fields (if present) are valid URLs.
NSArray *urlFields = @[
kIssuerKey,
kAuthorizationEndpointKey,
kTokenEndpointKey,
kJWKSURLKey
kUserinfoEndpointKey,
kRegistrationEndpointKey,
kJWKSURLKey,
kOPTosURIKey,
kOPPolicyURIKey
];

for (NSString *field in requiredURLFields) {
if (![NSURL URLWithString:dictionary[field]]) {
for (NSString *field in urlFields) {
if (dictionary[field] && ![NSURL URLWithString:dictionary[field]]) {
if (error) {
NSString *errorText = [NSString stringWithFormat:kInvalidURLFieldErrorText, field];
*error = [OIDErrorUtilities errorWithCode:OIDErrorCodeInvalidDiscoveryDocument
Expand Down