This issue will deliver the Client Registration Endpoint, which is defined in OpenID Connect Dynamic Client Registration 1.0.
NOTE: This issue should NOT implement the Client Configuration Endpoint - it MAY be implemented in a separate PR at a later point.
The Client Registration Endpoint should follow a similar implementation pattern as the Provider Configuration Endpoint gh-55.
At a minimum, the following artifacts should be produced:
OidcClientRegistrationEndpointFilter (reference OidcProviderConfigurationEndpointFilter)OidcClientRegistration (reference OidcProviderConfiguration)OidcClientMetadataClaimAccessor (reference OidcProviderMetadataClaimAccessor)OidcClientMetadataClaimNames (reference OidcProviderMetadataClaimNames)OidcClientRegistrationHttpMessageConverter (reference OidcProviderConfigurationHttpMessageConverter)
The OidcClientMetadataClaimAccessor should only implement the REQUIRED claims and may implement the OPTIONAL claims if it's applicable to a feature that is currently implemented.
Take note of Section 3. Client Registration Endpoint:
The Client Registration Endpoint is an OAuth 2.0 Protected Resource through which a new Client registration can be requested. The OpenID Provider MAY require an Initial Access Token that is provisioned out-of-band (in a manner that is out of scope for this specification) to restrict registration requests to only authorized Clients or developers.
Initial Access Token Requirements
- Client registration is only allowed for (existing) clients that have an (initial) access token that was obtained using the
client_credentials grant.
- The initial access token should contain the scope
client.create and no other additional scopes.
- The initial access token should have similar attributes as
OAuth2AuthorizationCode (authorization_code grant) with a time-to-live of 5 mins and can only be used once.
- The initial access token must be revoked after it is used.
- The client registration endpoint is a protected resource that requires an OAuth access token (initial access token) containing the
client.create scope, therefore, we need to leverage/integrate HttpSecurity.oauth2ResourceServer().jwt().
This issue will deliver the Client Registration Endpoint, which is defined in OpenID Connect Dynamic Client Registration 1.0.
NOTE: This issue should NOT implement the Client Configuration Endpoint - it MAY be implemented in a separate PR at a later point.
The Client Registration Endpoint should follow a similar implementation pattern as the Provider Configuration Endpoint gh-55.
At a minimum, the following artifacts should be produced:
OidcClientRegistrationEndpointFilter(referenceOidcProviderConfigurationEndpointFilter)OidcClientRegistration(referenceOidcProviderConfiguration)OidcClientMetadataClaimAccessor(referenceOidcProviderMetadataClaimAccessor)OidcClientMetadataClaimNames(referenceOidcProviderMetadataClaimNames)OidcClientRegistrationHttpMessageConverter(referenceOidcProviderConfigurationHttpMessageConverter)The
OidcClientMetadataClaimAccessorshould only implement the REQUIRED claims and may implement the OPTIONAL claims if it's applicable to a feature that is currently implemented.Take note of Section 3. Client Registration Endpoint:
Initial Access Token Requirements
client_credentialsgrant.client.createand no other additional scopes.OAuth2AuthorizationCode(authorization_codegrant) with a time-to-live of 5 mins and can only be used once.client.createscope, therefore, we need to leverage/integrateHttpSecurity.oauth2ResourceServer().jwt().