Skip to content

Commit 9ab988e

Browse files
rlewczukrlewczuk
committed
Client authentication with JWT assertion
Closes spring-projectsgh-59
1 parent 9053e31 commit 9ab988e

File tree

38 files changed

+1953
-54
lines changed

38 files changed

+1953
-54
lines changed

‎oauth2-authorization-server/spring-security-oauth2-authorization-server.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ dependencies {
1919
testCompile 'org.assertj:assertj-core'
2020
testCompile 'org.mockito:mockito-core'
2121
testCompile 'com.jayway.jsonpath:json-path'
22+
testCompile 'com.squareup.okhttp3:mockwebserver'
2223

2324
testRuntime 'org.hsqldb:hsqldb'
2425

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java

+81
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,29 @@ public B tokenEndpointAuthenticationMethods(Consumer<List<String>> authenticatio
128128
return getThis();
129129
}
130130

131+
/**
132+
* Add this client signing algorithm to the collection of {@code token_endpoint_auth_signing_alg_values_supported}
133+
* in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
134+
*
135+
* @param signingAlgorithm the JWS signing algorithms supported by the token endpoint
136+
* @return the {@link AbstractBuilder} for further configuration
137+
*/
138+
public B tokenEndpointAuthenticationSigningAlgorithm(String signingAlgorithm) {
139+
addClaimToClaimList(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithm);
140+
return getThis();
141+
}
142+
143+
/**
144+
* A {@code Consumer} of the client signing algorithms(s) allowing the ability to add, replace, or remove.
145+
*
146+
* @param signingAlgorithmsConsumer a {@code Consumer} of the client signing algorithm(s) supported by the OAuth 2.0 Token Endpoint
147+
* @return the {@link AbstractBuilder} for further configuration
148+
*/
149+
public B tokenEndpointAuthenticationSigningAlgorithms(Consumer<List<String>> signingAlgorithmsConsumer) {
150+
acceptClaimValues(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithmsConsumer);
151+
return getThis();
152+
}
153+
131154
/**
132155
* Use this {@code jwks_uri} in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
133156
*
@@ -240,6 +263,29 @@ public B tokenRevocationEndpointAuthenticationMethods(Consumer<List<String>> aut
240263
return getThis();
241264
}
242265

266+
/**
267+
* Add this client signing algorithm to the collection of {@code revocation_endpoint_auth_signing_alg_values_supported}
268+
* in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
269+
*
270+
* @param signingAlgorithm the JWS signing algorithms supported by the token revocation endpoint
271+
* @return the {@link AbstractBuilder} for further configuration
272+
*/
273+
public B tokenRevocationEndpointAuthenticationSigningAlgorithm(String signingAlgorithm) {
274+
addClaimToClaimList(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithm);
275+
return getThis();
276+
}
277+
278+
/**
279+
* A {@code Consumer} of the client signing algorithms(s) allowing the ability to add, replace, or remove.
280+
*
281+
* @param signingAlgorithmsConsumer a {@code Consumer} of the client signing algorithm(s) supported by the OAuth 2.0 Token Revocation Endpoint
282+
* @return the {@link AbstractBuilder} for further configuration
283+
*/
284+
public B tokenRevocationEndpointAuthenticationSigningAlgorithms(Consumer<List<String>> signingAlgorithmsConsumer) {
285+
acceptClaimValues(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithmsConsumer);
286+
return getThis();
287+
}
288+
243289
/**
244290
* Use this {@code introspection_endpoint} in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
245291
*
@@ -273,6 +319,29 @@ public B tokenIntrospectionEndpointAuthenticationMethods(Consumer<List<String>>
273319
return getThis();
274320
}
275321

322+
/**
323+
* Add this client signing algorithm to the collection of {@code introspection_endpoint_auth_signing_alg_values_supported}
324+
* in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
325+
*
326+
* @param signingAlgorithm the JWS signing algorithms supported by the token introspection endpoint
327+
* @return the {@link AbstractBuilder} for further configuration
328+
*/
329+
public B tokenIntrospectionEndpointAuthenticationSigningAlgorithm(String signingAlgorithm) {
330+
addClaimToClaimList(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithm);
331+
return getThis();
332+
}
333+
334+
/**
335+
* A {@code Consumer} of the client signing algorithms(s) allowing the ability to add, replace, or remove.
336+
*
337+
* @param signingAlgorithmsConsumer a {@code Consumer} of the client signing algorithm(s) supported by the OAuth 2.0 Token Introspection Endpoint
338+
* @return the {@link AbstractBuilder} for further configuration
339+
*/
340+
public B tokenIntrospectionEndpointAuthenticationSigningAlgorithms(Consumer<List<String>> signingAlgorithmsConsumer) {
341+
acceptClaimValues(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED, signingAlgorithmsConsumer);
342+
return getThis();
343+
}
344+
276345
/**
277346
* Add this Proof Key for Code Exchange (PKCE) {@code code_challenge_method} to the collection of {@code code_challenge_methods_supported}
278347
* in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
@@ -340,6 +409,10 @@ protected void validate() {
340409
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenEndpointAuthenticationMethods must be of type List");
341410
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenEndpointAuthenticationMethods cannot be empty");
342411
}
412+
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED) != null) {
413+
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenEndpointAuthenticationSigningAlgorithms must be of type List");
414+
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenEndpointAuthenticationSigningAlgorithms cannot be empty");
415+
}
343416
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI) != null) {
344417
validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI), "jwksUri must be a valid URL");
345418
}
@@ -361,13 +434,21 @@ protected void validate() {
361434
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenRevocationEndpointAuthenticationMethods must be of type List");
362435
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenRevocationEndpointAuthenticationMethods cannot be empty");
363436
}
437+
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED) != null) {
438+
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenRevocationEndpointAuthenticationSigningAlgorithms must be of type List");
439+
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenRevocationEndpointAuthenticationSigningAlgorithms cannot be empty");
440+
}
364441
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT) != null) {
365442
validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT), "tokenIntrospectionEndpoint must be a valid URL");
366443
}
367444
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_METHODS_SUPPORTED) != null) {
368445
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenIntrospectionEndpointAuthenticationMethods must be of type List");
369446
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_METHODS_SUPPORTED), "tokenIntrospectionEndpointAuthenticationMethods cannot be empty");
370447
}
448+
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED) != null) {
449+
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenIntrospectionEndpointAuthenticationSigningAlgorithms must be of type List");
450+
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED), "tokenIntrospectionEndpointAuthenticationSigningAlgorithms cannot be empty");
451+
}
371452
if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.CODE_CHALLENGE_METHODS_SUPPORTED) != null) {
372453
Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.CODE_CHALLENGE_METHODS_SUPPORTED), "codeChallengeMethods must be of type List");
373454
Assert.notEmpty((List<?>) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.CODE_CHALLENGE_METHODS_SUPPORTED), "codeChallengeMethods cannot be empty");

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimAccessor.java

+33
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,17 @@ default List<String> getTokenEndpointAuthenticationMethods() {
6767
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED);
6868
}
6969

70+
/**
71+
* Returns the JWS signing algorithms supported by the token endpoint authentication for
72+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
73+
*
74+
* @return the JWS signing algorithms supported by the token endpoint authentication for
75+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
76+
*/
77+
default List<String> getTokenEndpointAuthenticationSigningAlgorithms() {
78+
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED);
79+
}
80+
7081
/**
7182
* Returns the {@code URL} of the JSON Web Key Set {@code (jwks_uri)}.
7283
*
@@ -121,6 +132,17 @@ default List<String> getTokenRevocationEndpointAuthenticationMethods() {
121132
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_METHODS_SUPPORTED);
122133
}
123134

135+
/**
136+
* Returns the JWS signing algorithms supported by the token revocation endpoint authentication for
137+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
138+
*
139+
* @return the JWS signing algorithms supported by the token revocation endpoint authentication for
140+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
141+
*/
142+
default List<String> getTokenRevocationEndpointAuthenticationSigningAlgorithms() {
143+
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED);
144+
}
145+
124146
/**
125147
* Returns the {@code URL} of the OAuth 2.0 Token Introspection Endpoint {@code (introspection_endpoint)}.
126148
*
@@ -139,6 +161,17 @@ default List<String> getTokenIntrospectionEndpointAuthenticationMethods() {
139161
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_METHODS_SUPPORTED);
140162
}
141163

164+
/**
165+
* Returns the JWS signing algorithms supported by the token endpoint authentication for
166+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
167+
*
168+
* @return the JWS signing algorithms supported by the token endpoint authentication for
169+
* the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
170+
*/
171+
default List<String> getTokenIntrospectionEndpointAuthenticationSigningAlgorithms() {
172+
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED);
173+
}
174+
142175
/**
143176
* Returns the Proof Key for Code Exchange (PKCE) {@code code_challenge_method} values supported {@code (code_challenge_methods_supported)}.
144177
*

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimNames.java

+18
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,12 @@ public interface OAuth2AuthorizationServerMetadataClaimNames {
4646
*/
4747
String TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED = "token_endpoint_auth_methods_supported";
4848

49+
/**
50+
* {@code token_endpoint_auth_signing_alg_values_supported} - the JWS signing algorithms supported by the token
51+
* endpoint authentication for the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
52+
*/
53+
String TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED = "token_endpoint_auth_signing_alg_values_supported";
54+
4955
/**
5056
* {@code jwks_uri} - the {@code URL} of the JSON Web Key Set
5157
*/
@@ -76,6 +82,12 @@ public interface OAuth2AuthorizationServerMetadataClaimNames {
7682
*/
7783
String REVOCATION_ENDPOINT_AUTH_METHODS_SUPPORTED = "revocation_endpoint_auth_methods_supported";
7884

85+
/**
86+
* {@code token_endpoint_auth_signing_alg_values_supported} - the JWS signing algorithms supported by the token revocation
87+
* endpoint authentication for the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
88+
*/
89+
String REVOCATION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED = "revocation_endpoint_auth_signing_alg_values_supported";
90+
7991
/**
8092
* {@code introspection_endpoint} - the {@code URL} of the OAuth 2.0 Token Introspection Endpoint
8193
*/
@@ -86,6 +98,12 @@ public interface OAuth2AuthorizationServerMetadataClaimNames {
8698
*/
8799
String INTROSPECTION_ENDPOINT_AUTH_METHODS_SUPPORTED = "introspection_endpoint_auth_methods_supported";
88100

101+
/**
102+
* {@code token_endpoint_auth_signing_alg_values_supported} - the JWS signing algorithms supported by the token introspection
103+
* endpoint authentication for the {@code private_key_jwt} and {@code client_secret_jwt} authentication methods
104+
*/
105+
String INTROSPECTION_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED = "introspection_endpoint_auth_signing_alg_values_supported";
106+
89107
/**
90108
* {@code code_challenge_methods_supported} - the Proof Key for Code Exchange (PKCE) {@code code_challenge_method} values supported
91109
*/

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcClientMetadataClaimAccessor.java

+24
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,20 @@ default String getTokenEndpointAuthenticationMethod() {
9999
return getClaimAsString(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHOD);
100100
}
101101

102+
/**
103+
* Returns the {@link SignatureAlgorithm JWS} algorithm that must be used for signing the JWT used to authenticate
104+
* the Client at the Token Endpoint for the {@code private_key_jwt} and {@code client_secret_jwt} authentication
105+
* methods {@code (token_endpoint_auth_signing_alg)}
106+
*
107+
* @return the {@link SignatureAlgorithm JWS} algorithm that must be used for signing the JWT used to authenticate
108+
* the Client at the Token Endpoint for the {@code private_key_jwt} and {@code client_secret_jwt}
109+
* authentication methods {@code (token_endpoint_auth_signing_alg)}
110+
* @since 0.2.1
111+
*/
112+
default String getTokenEndpointAuthenticationSigningAlgorithm() {
113+
return getClaimAsString(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG);
114+
}
115+
102116
/**
103117
* Returns the OAuth 2.0 {@code grant_type} values that the Client will restrict itself to using {@code (grant_types)}.
104118
*
@@ -155,4 +169,14 @@ default URL getRegistrationClientUrl() {
155169
return getClaimAsURL(OidcClientMetadataClaimNames.REGISTRATION_CLIENT_URI);
156170
}
157171

172+
/**
173+
* Returns {@code URL} for the Client's JSON Web Key Set {@code (jwks_uri)}
174+
*
175+
* @return {@code URL} for the Client's JSON Web Key Set {@code (jwks_uri)}
176+
* @since 0.2.1
177+
*/
178+
default URL getJwkSetUrl() {
179+
return getClaimAsURL(OidcClientMetadataClaimNames.JWKS_URI);
180+
}
181+
158182
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcClientMetadataClaimNames.java

+14
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package org.springframework.security.oauth2.core.oidc;
1717

1818
import org.springframework.security.oauth2.jose.jws.JwsAlgorithm;
19+
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
1920

2021
/**
2122
* The names of the "claims" defined by OpenID Connect Dynamic Client Registration 1.0
@@ -95,4 +96,17 @@ public interface OidcClientMetadataClaimNames {
9596
*/
9697
String REGISTRATION_CLIENT_URI = "registration_client_uri";
9798

99+
/**
100+
* {@code jwks_uri} - {@code URL} for the Client's JSON Web Key Set
101+
* @since 0.2.1
102+
*/
103+
String JWKS_URI = "jwks_uri";
104+
105+
/**
106+
* {@code token_endpoint_auth_signing_alg} - {@link SignatureAlgorithm JWS} algorithm that must be used for signing
107+
* the JWT used to authenticate the Client at the Token Endpoint for the {@code private_key_jwt} and {@code client_secret_jwt}
108+
* authentication methods
109+
* @since 0.2.1
110+
*/
111+
String TOKEN_ENDPOINT_AUTH_SIGNING_ALG = "token_endpoint_auth_signing_alg";
98112
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcClientRegistration.java

+24
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,20 @@ public Builder tokenEndpointAuthenticationMethod(String tokenEndpointAuthenticat
172172
return claim(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_METHOD, tokenEndpointAuthenticationMethod);
173173
}
174174

175+
/**
176+
* Sets the {@link SignatureAlgorithm JWS} algorithm that must be used for signing the JWT used to authenticate
177+
* the Client at the Token Endpoint for the {@code private_key_jwt} and {@code client_secret_jwt} authentication
178+
* methods
179+
* @param signingAlgorithm the {@link SignatureAlgorithm JWS} algorithm that must be used for signing
180+
* the JWT used to authenticate the Client at the Token Endpoint for the {@code private_key_jwt} and
181+
* {@code client_secret_jwt} authentication methods
182+
* @return the {@link Builder} for further configuration
183+
* @since 0.2.1
184+
*/
185+
public Builder tokenEndpointAuthenticationSigningAlgorithm(String signingAlgorithm) {
186+
return claim(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, signingAlgorithm);
187+
}
188+
175189
/**
176190
* Add the OAuth 2.0 {@code grant_type} that the Client will restrict itself to using, OPTIONAL.
177191
*
@@ -273,6 +287,16 @@ public Builder registrationClientUrl(String registrationClientUrl) {
273287
return claim(OidcClientMetadataClaimNames.REGISTRATION_CLIENT_URI, registrationClientUrl);
274288
}
275289

290+
/**
291+
* Sets {@code URL} for the Client's JSON Web Key Set {@code (jwks_uri)}
292+
* @param jwksSetUrl {@code URL} for the Client's JSON Web Key Set {@code (jwks_uri)}
293+
* @return the {@link Builder} for further configuration
294+
* @since 0.2.1
295+
*/
296+
public Builder jwkSetUrl(String jwksSetUrl) {
297+
return claim(OidcClientMetadataClaimNames.JWKS_URI, jwksSetUrl);
298+
}
299+
276300
/**
277301
* Sets the claim.
278302
*

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/http/converter/OidcClientRegistrationHttpMessageConverter.java

+2
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ private MapOidcClientRegistrationConverter() {
150150
claimConverters.put(OidcClientMetadataClaimNames.RESPONSE_TYPES, collectionStringConverter);
151151
claimConverters.put(OidcClientMetadataClaimNames.SCOPE, MapOidcClientRegistrationConverter::convertScope);
152152
claimConverters.put(OidcClientMetadataClaimNames.ID_TOKEN_SIGNED_RESPONSE_ALG, stringConverter);
153+
claimConverters.put(OidcClientMetadataClaimNames.JWKS_URI, stringConverter);
154+
claimConverters.put(OidcClientMetadataClaimNames.TOKEN_ENDPOINT_AUTH_SIGNING_ALG, stringConverter);
153155
this.claimTypeConverter = new ClaimTypeConverter(claimConverters);
154156
}
155157

0 commit comments

Comments
 (0)