Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RP Metadata Policy Compliance Check #87

Open
SECtim opened this issue Sep 10, 2024 · 2 comments
Open

RP Metadata Policy Compliance Check #87

SECtim opened this issue Sep 10, 2024 · 2 comments
Assignees

Comments

@SECtim
Copy link
Collaborator

SECtim commented Sep 10, 2024

Step 4 in Section 12.2.2.2 on RP processing of an explicit client registration response says:

The RP MUST ensure that the metadata it was registered with at the OP complies with the Trust Chain openid_relying_party policies, which Trust Chain is resolved using the trust_anchor_id and authority_hints claims of the received registration Entity Statement. The RP SHOULD perform this check by applying the resolved policies to the metadata as specified in Section 6.1.4.1, or utilize another equivalent method.

While the intention of this step is obvious, the second sentence remains vague: What exactly is to be checked here?
Should RP apply the resolved policies to the received metadata and check that this policy application did not change the metadata?
Or something different?

@selfissued
Copy link
Member

At a minimum, applying the policies cannot result in any policy conflicts. I'll consider how to better describe this.

I don't know what the "or utilize another equivalent method" language is about. @rohe ?

@rohe
Copy link
Collaborator

rohe commented Nov 4, 2024

If we go back a year or more (not sure exactly when the switch happened) the OP was expected to calculate a set of metadata policies that if used on the RP's metadata would result in metadata the OP was happy with.
This was a bit cumbersome so we decided to have the OP just send back the complete metadata it wanted the RP to use.
The RP should still verify that the received metadata complies with metadata policies it can collect from the trust chain that starts with itself and ends in the TA with entity_id = trust_anchor_id.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants