features.clientIdMetadataDocument

draft-ietf-oauth-client-id-metadata-document-03 - OAuth Client ID Metadata Document (CIMD)

Specifies whether the authorization server shall support resolving client metadata from Client Identifier URLs used as client_id values. When enabled, if a client_id is an HTTPS URL conforming to the specification’s requirements, the authorization server shall fetch the Client ID Metadata Document from that URL and use it as the client’s registration data, without requiring prior client registration.

The token_endpoint_auth_methods_supported client metadata property is processed even when features.rpMetadataChoices is disabled. When private_key_jwt is advertised and supported by the server, it is selected regardless of the client’s array order or singular authentication method preference. When neither authentication property is provided, the client’s authentication method is none.

When displaying a client’s logo_uri, applications must prefetch and validate the image and serve it from a trusted server. Applications should display the hostname of the Client Identifier URL to help users identify the client and apply their own trust policies to client-provided metadata.

default value:

{
  ack: undefined,
  allowClient: [AsyncFunction: allowClient], // see expanded details below
  allowFetch: [AsyncFunction: allowFetch], // see expanded details below
  cacheDuration: {
    max: 86400,
    min: 30
  },
  enabled: false
}

(Click to expand) features.clientIdMetadataDocument options details

allowClient

Specifies a helper function that shall be invoked every time a client resolved from a Client ID Metadata Document is about to be used, including when served from cache. This function enables per-request evaluation of trust and authorization policies for metadata-document-resolved clients. Return true to allow the client, or false to reject it.

default value:

async function allowClient(
  ctx: KoaContextWithOIDC,
  client: Client,
): Promise<boolean> {
  return true;
}

allowFetch

Specifies a helper function that shall be invoked before fetching a Client ID Metadata Document from a Client Identifier URL. This function enables enforcement of domain allowlisting, rate limiting, or other security policies. Return true to allow the fetch, or false to reject the client_id. Reject identifiers of trusted authorization servers and resource servers to avoid identity confusion. The provider’s own issuer identifier is rejected automatically.

default value:

async function allowFetch(
  ctx: KoaContextWithOIDC,
  clientId: string,
): Promise<boolean> {
  return true;
}

cacheDuration

Specifies the minimum and maximum cache duration bounds (in seconds) applied to HTTP cache headers when caching fetched Client ID Metadata Documents. Cache-Control and Expires response headers are respected within these bounds.

default value:

{
  max: 86400,
  min: 30
}