fix: accept only the issuer as client assertion aud for non-CIBA clients - #370
Merged
Merged
Conversation
FAPI 2.0 Security Profile Final §5.3.2.1 requires the authorization server to "only accept its issuer identifier value ... as a string in the aud claim received in client authentication assertions". The token endpoint also accepted its own URL (and its mTLS alias), per RFC 7523 §3's older allowance. The OIDF suite's new fapi2-security-profile-final-ensure-invalid-client-assertions-fail module now checks this at the token endpoint for the client-credentials variant, failing the scheduled conformance run. Endpoint-URL audiences are now accepted only for clients registered for CIBA: CIBA Core 1.0 §7.1 requires the token and backchannel authentication endpoint URLs to be accepted, and the FAPI-CIBA suite signs every token-endpoint assertion (refresh included) with the token endpoint URL. PAR stays issuer-only for every client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the scheduled FAPI Conformance failure on
main(run 35848443579):AS baseline-client-credentialsandAS mtls-client-credentialseach failedfapi2-security-profile-final-ensure-invalid-client-assertions-fail, block "Client assertion with token endpoint as aud".Cause. FAPI 2.0 Security Profile Final §5.3.2.1: the AS "shall only accept its issuer identifier value … as a string in the aud claim received in client authentication assertions".
acceptableClientAssertionAudiencesalso accepted the token endpoint URL (and its mTLS alias) at the token endpoint, per RFC 7523 §3's older allowance. The suite added this check upstream on 2026-09-22 (commitf096b51f0). Only the client-credentials variant exercises it at the token endpoint, because the auth-code variants' first authenticated endpoint is PAR, which was already issuer-only.Fix. Endpoint-URL audiences are now accepted only for clients registered for CIBA (
BackchannelAuthenticationRequestAlgorithmset). Every other client is issuer-only at every endpoint.Behaviour change for integrators: a non-CIBA client that signed
audas the token endpoint URL now getsinvalid_client. go-fapi's ownclientpackage already signs with the issuer.Changes
server/par.go: the CIBA gate inacceptableClientAssertionAudiences, plus a rewritten doc comment.TestExchangeBackchannelAuthenticationAcceptsTokenEndpointURLAsClientAssertionAudiencechecks a CIBA client still authenticates at the token endpoint with the token URL.cmd/conformance-asclient-credentials smoke tests now sign with the issuer, as the FAPI2 suite does.Test plan
go vet,go test -race ./...,golangci-lintcleanmainwith the latest suite image (identical module, block and condition counts)AS baseline-client-credentials0 failures (1166 successes, previously 1163 + 3 failures) andAS mtls-client-credentials0 failures (548, previously 545 + 3). All four CIBA legs are unchanged and clean.🤖 Generated with Claude Code