Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define additional error codes #145

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

selfissued
Copy link
Member

Fixes #136

Note that we probably also want to harmonize missing_trust_anchor with invalid_trust_anchor and trust_chain_validation_failed with invalid_trust_chain.

The Trust Anchor cannot be found or used.
The HTTP response status code SHOULD be 404 (Not Found).
</t>
<t hangText="trust_chain_validation_failed">
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing description - add "The Trust Chain validation failed"?

<vspace/>
The HTTP response status code SHOULD be 400 (Bad Request).
</t>
<t hangText="invalid_metadata">
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the intended use of this error code?

In the spec we say, when the EC metadata doesn't pass the metadata_policy checks, this must invalidate the Trust Chain (i.e. trust_chain_validation_failed).

If a policy error or another error is encountered during the metadata policy resolution or its application, the Trust Chain MUST be considered invalid.

After that, the OP can take the resolved metadata JSON object and try to use to register the RP. So, up to this point, we are in the Federation layer, which is "app layer blind", and the resolved metadata is just a JSON object that passed the Trust Chain metadata_policy (if any).

In OAuth / OIDC (dyn reg), when the submitted metadata has an issue, this must result in an invalid_client_metadata error.

invalid_client_metadata
The value of one of the Client Metadata fields is invalid and the server has rejected this request. Note that an Authorization Server MAY choose to substitute a valid value for any requested parameter of a Client's Metadata.

Thus, in OIDC, the only use I see for this code is in auto reg, to signal that the Trust Chain validation was successful, but the RP failed to get registered because the resolved metadata has an issue. But why not reuse the existing invalid_client_metadata code for that?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the spec we say, when the EC metadata doesn't pass the metadata_policy checks, this must invalidate the Trust Chain (i.e. trust_chain_validation_failed).

I read this error case as exactly that, but with a more precise hinting, why the validation failed. I think it makes very much a difference if the chain itself is not valid or "only" the metadata. While this still leads to an invalid trust chain, imo a separate error code makes sense.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Resolve Endpoint Error Response
5 participants