OpenID Connect Provider Metadata (OP)¶

An OP MUST publish in its EC a Metadata of type federation_entity and a Metadata of type openid_provider, as reported in the following example:

{
   "metadata":{
     "federation_entity":{
       ...
     }
     "openid_provider":{
       ...
     }
   }
}

The EC of an OP MUST configure a Metadata of type "federation_entity" and contain at least the following mandatory parameters:

Claim	Description	Supported by
organization_name	See OIDC-FED Section 4.8
homepage_uri	See OIDC-FED Section 4.8
policy_uri	See OIDC-FED Section 4.8
logo_uri	URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8
contacts	Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8
federation_resolve_endpoint	See Section Federation Endpoint and OIDC-FED Section 4.6.

The EC of an OP MUST configure a metadata of type "openid_provider", that MUST contain at least the following mandatory parameters:

Claim	Description	Supported by
issuer	See OpenID.Discovery#OP_Metadata. It MUST contain an HTTPS URL that uniquely identifies the OP.
authorization_endpoint	See OpenID.Discovery#OP_Metadata.
token_endpoint	See OpenID.Discovery#OP_Metadata.
userinfo_endpoint	See OpenID.Discovery#OP_Metadata.
introspection_endpoint	See RFC 8414#page-4.
revocation_endpoint	See RFC 8414#page-4.
revocation_endpoint_auth_methods_supported	See RFC 8414#page-4. The supported value is private_key_jwt
code_challenge_methods_supported	See RFC 8414#page-4. The OP MUST support S256 (see RFC 7636#section-4.3).
scopes_supported	See OpenID.Discovery#OP_Metadata. The supported values are openid and offline_access. CIE id supports also profile, email. For more details, see the section User's Claims.
response_types_supported	See OpenID.Discovery#OP_Metadata. The supported value is code.
response_modes_supported	See OpenID.Discovery#OP_Metadata. The supported values are form_post and query.
grant_types_supported	See OpenID.Discovery#OP_Metadata. The supported values are refresh_token and authorization_code.
acr_values_supported	See OpenID.Discovery#OP_Metadata. The supported values are: `https://www.spid.gov.it/SpidL1` `https://www.spid.gov.it/SpidL2` `https://www.spid.gov.it/SpidL3`
subject_types_supported	See OpenID.Discovery#OP_Metadata. The supported value is pairwise.
id_token_signing_alg_values_supported	See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.
id_token_encryption_alg_values_supported	See OpenID.Discovery#OP_Metadata. See key encryption Cryptographic algorithms.
id_token_encryption_enc_values_supported	See OpenID.Discovery#OP_Metadata. See content encryption Cryptographic algorithms.
userinfo_signing_alg_values_supported	See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.
userinfo_encryption_alg_values_supported	See OpenID.Discovery#OP_Metadata. See key encryption Cryptographic algorithms.
userinfo_encryption_enc_values_supported	See OpenID.Discovery#OP_Metadata. See content encryption Cryptographic algorithms.
request_object_signing_alg_values_supported	See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.
token_endpoint_auth_methods_supported	See OpenID.Discovery#OP_Metadata. The supported value is private_key_jwt
token_endpoint_auth_signing_alg_values_supported	See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.
claims_supported	See OpenID.Discovery#OP_Metadata. See User Claims for more details.
claims_parameter_supported	See OpenID.Discovery#OP_Metadata. The supported value is true.
request_parameter_supported	See OpenID.Discovery#OP_Metadata. The supported value is true.
authorization_response_iss_parameter_supported	See RFC 9207#section-3. It must contain true.
jwks	See OIDC-FED Section 4.2 and JWK.
client_registration_types_supported	See OIDC-FED Section 4.2. The supported value is automatic.
request_authentication_methods_supported	See OIDC-FED Section 4.2`_. The supported value is request_object.
request_authentication_signing_alg_values_supported	See OIDC-FED Section 4.2. See signature Cryptographic algorithms.

Until otherwise indicated by AgID, the parameters request_object_encryption_alg_values_supported e request_object_encryption_enc_values_supported, MUST NOT be included in the SPID OP Metadata.

Warning

The OP Metadata of type "openid_provider" exposes the claim jwks as regulated by OID-FED instead of the claim jwks_uri as required at OpenID.Discovery#OP_Metadata.

Docs Italia beta

Public documents, made digital.

OpenID Connect Provider Metadata (OP)¶