Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for ID token encryption. #3

Open
chamathns opened this issue Oct 14, 2020 · 1 comment
Open

Add support for ID token encryption. #3

chamathns opened this issue Oct 14, 2020 · 1 comment

Comments

@chamathns
Copy link
Contributor

Description:
Currently there is no support for ID token encryption with the java-oidc-sdk. As per the OIDC spec [1], it is optional to encrypt the ID token. But, encrypting the ID token using JWS[2] would provide "confidentiality".

[1] - https://openid.net/specs/openid-connect-messages-1_0-10.html#id_token
[2] - https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41

@darshanasbg
Copy link
Member

Once implemented, it should adhere to the ID Token validation rules on the encrypted ID Tokens.

If the ID Token is encrypted, decrypt it using the keys and algorithms that the Client specified during Registration that the OP was to use to encrypt the ID Token. If encryption was negotiated with the OP at Registration time and the ID Token is not encrypted, the RP SHOULD reject it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants