Closed tnorimat closed 3 years ago
FAPI-RW-5.2.3-8 states that all of query parameters in an authorization code request should be included in signed Request Object in order to protect those query parameters (substitution, tampering, insertion by malicious one).
FAPI-R-5.2.3-7 states that "scope" query parameter should be added in an authorization code request.
Both are requirements for Client, but they imply that Authorization Server should also check them and return error if Client does not obey them.
related keycloak-jira ticket created : https://issues.jboss.org/browse/KEYCLOAK-11256
@tnorimat I was able to fix this defect in Keycloak and test it through FAPI-compliance suit. I see in the JIRA ticket and other relevant tickets and docs and found that there is a proposed plan to have Client conformance profiles(https://issues.redhat.com/browse/KEYCLOAK-11612) which as you rightly mentioned is an epic task.
So, shall we not go ahead and try fixing these outstanding FAPI compliance defects. let me know your thoughts.
@pritish-nitb Hello. As you mentioned, I have the plan to resolve this issue by KEYCLOAK-14204 . To do so, I need to establish the basics of Client Policies mentioned in KEYCLOAK-14189 and its pull-request in under review by keycloak development team. Therefore, could you please wait for my work on it?
I hope that Client Policies makes it easy for us to support not only FAPI Security Profile (RO, RW) but also other OAuth2/OIDC based security profiles like FAPI CIBA security profile, OpenBanking Security Profile (UK), Consumer Data Right (Australia), security profile for Native App, security profile for SPA, etc.
@tnorimat and @pritish-nitb thank you for your contribution on Keycloak FAPI. I think if we can continue the discussion of this thread further in the keycloak-dev mailing list ( https://groups.google.com/g/keycloak-dev ) ,it may help to get visibility from others who are interested in it. What do you think about it?
@VinodAnandan Yes, I agree with you.
According to FAPI-RW-5.2.3-8(https://openid.net/specs/openid-financial-api-part-2-ID2.html#public-client), FAPI-R-5.2.3-7(https://openid.net/specs/openid-financial-api-part-1-ID2.html#public-client) and OIDCC-3.3.2.6 (https://openid.net/specs/openid-connect-core-1_0.html#HybridAuthError) because FAPI RW uses hybrid flow :