OpenID Connect Relying Party Metadata (RP)¶

An RP MUST publish in its EC a Metadata of type federation_entity and a Metadata of type openid_relying_party, as reported in the following example:

{
   "metadata":{
     "federation_entity":{
       ...
     }
     "openid_relying_party":{
       ...
     }
   }
}

The OP Metadata of type "federation_entity" MUST contain at least the following mandatory parameters:

Claim	Description	Supported by
organization_name	See OIDC-FED Section 4.8
homepage_uri	See OIDC-FED Section 4.8
policy_uri	See OIDC-FED Section 4.8
logo_uri	URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8
contacts	Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8
federation_resolve_endpoint	See Section Federation Endpoint and OIDC-FED Section 4.6.

The RP Metadata of type "openid_relying_party" MUST contain at least the following mandatory parameters:

Claim	Description	Supported by*
redirect_uris	See OpenID.Registration#ClientMetadata. It is mandatory using an HTTPS schema in case of a web-based client.
grant_types	See OpenID.Registration#ClientMetadata. The supported values are authorization_code and refresh_token.
jwks	See OpenID.Registration#ClientMetadata and JWK.
signed_jwks_uri	See OIDC-FED.
id_token_signed_response_alg	See OpenID.Registration#ClientMetadata. See signature Cryptographic algorithms.
id_token_encrypted_response_alg	OPTIONAL. If it is contained in the RP Metadata, the ID Token MUST be a nested signed and encrypted JWT. See OpenID.Registration#ClientMetadata. See key encryption Cryptographic algorithms.
id_token_encrypted_response_enc	See OpenID.Registration#ClientMetadata. This content encryption is required only if the id_token_encrypted_response_alg is given. See key encryption Cryptographic algorithms.
userinfo_signed_response_alg	See OpenID.Registration#ClientMetadata. See signature Cryptographic algorithms.
userinfo_encrypted_response_alg	See OpenID.Registration#ClientMetadata. See key encryption Cryptographic algorithms.
userinfo_encrypted_response_enc	See OpenID.Registration#ClientMetadata. See content encryption Cryptographic algorithms.
token_endpoint_auth_method	See OpenID.Registration#ClientMetadata. The required value is private_key_jwt.
client_id	See OpenID.Registration. It MUST contain an HTTPS URL that uniquely identifies the RP.
client_registration_types	See OIDC-FED Section 4.1. The required value is automatic.
response_types	JSON array containing a list of the OAuth 2.0 response_type values that the RP is declaring that it will restrict itself to using. It MUST contain the value code.

Note

The URIs contained in the claim redirect_uris MAY also use custom schemas (e.g. myapp://) in order to support mobile applications.

The RP Metadata "openid_relying_party" MUST use the jwks parameter.

The RP Metadata "openid_relying_party" MUST use the jwks or signed_jwks_uri.

Docs Italia beta

Public documents, made digital.

OpenID Connect Relying Party Metadata (RP)¶