-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Define additional error codes #145
base: main
Are you sure you want to change the base?
Conversation
The Trust Anchor cannot be found or used. | ||
The HTTP response status code SHOULD be 404 (Not Found). | ||
</t> | ||
<t hangText="trust_chain_validation_failed"> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Missing description - add "The Trust Chain validation failed"?
<vspace/> | ||
The HTTP response status code SHOULD be 400 (Bad Request). | ||
</t> | ||
<t hangText="invalid_metadata"> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the intended use of this error code?
In the spec we say, when the EC metadata
doesn't pass the metadata_policy
checks, this must invalidate the Trust Chain (i.e. trust_chain_validation_failed
).
If a policy error or another error is encountered during the metadata policy resolution or its application, the Trust Chain MUST be considered invalid.
After that, the OP can take the resolved metadata
JSON object and try to use to register the RP. So, up to this point, we are in the Federation layer, which is "app layer blind", and the resolved metadata
is just a JSON object that passed the Trust Chain metadata_policy
(if any).
In OAuth / OIDC (dyn reg), when the submitted metadata has an issue, this must result in an invalid_client_metadata
error.
invalid_client_metadata
The value of one of the Client Metadata fields is invalid and the server has rejected this request. Note that an Authorization Server MAY choose to substitute a valid value for any requested parameter of a Client's Metadata.
Thus, in OIDC, the only use I see for this code is in auto reg, to signal that the Trust Chain validation was successful, but the RP failed to get registered because the resolved metadata
has an issue. But why not reuse the existing invalid_client_metadata
code for that?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the spec we say, when the EC metadata doesn't pass the metadata_policy checks, this must invalidate the Trust Chain (i.e. trust_chain_validation_failed).
I read this error case as exactly that, but with a more precise hinting, why the validation failed. I think it makes very much a difference if the chain itself is not valid or "only" the metadata. While this still leads to an invalid trust chain, imo a separate error code makes sense.
Fixes #136
Note that we probably also want to harmonize
missing_trust_anchor
withinvalid_trust_anchor
andtrust_chain_validation_failed
withinvalid_trust_chain
.