openid / federation

8 stars 4 forks source link

Add return of federation_entity metadata if type is provided in resolve requests #43

Closed Razumain closed 1 month ago

Razumain commented 2 months ago

This has been discussed before with no resolution. I just implemented this and found that I needed to encode some solution.

Section 5.2.2. states:

It is RECOMMENDED that, when present, these metadata parameters occur in an Entity's federation_entity metadata. They MAY also be present in the Entity's metadata for other Entity Types, particularly when the values for those Entity Types differ from those for the federation_entity metadata.

This means that metadata for any type may find vital information about that entity, not in the metadata of the selected metadata entity type, but in the federation_entity metadata.

This is a problem when a resolve request contains a type parameter.

In the definition of resolve response in section 8.3.2, the content of the metadata parameter is defined as:

metadata
      REQUIRED. JSON object containing the resolved subject metadata, according to the requested type and expressed in the 
      metadata format defined in [Section 3](https://openid.net/specs/openid-federation-1_0.html#entity-statement).

If the requester is to be guaranteed to receive all metadata for the selected type, the federation_entity metadata, if present, must also be returned.

2 possible solutions to this issue is:

I originally requested the first option (I still like that best), but I have implemented the second to be compliant with the standard and other implementations of it.

selfissued commented 2 months ago

I've been thinking about this. Rather than having a special-case rule that also always returns federatino_entity metadata no matter what type is requested, I'd rather make the behavior explicit. I think we should allow multiple type values to be requested by allowing multiple occurrences of the type query parameter.

Razumain commented 2 months ago

I definitely agree with this. Allowing multiple type values is definitely a good thing that I have on my wish list.

However, the way the standard is written, the federation_entity has a special role here as the standard recommends common metadata values to be put here for any entity type. I don't like that use of federation_entity as a collector of common attributes and would like to change it. But as it is written now, I still think you allways have to return it regardless of type request.