Skip to content

Commit 65e3a5e

Browse files
jgrandjajgrandja
committed
Add authorization server metadata for DPoP support
Issue gh-1813 Closes gh-1951
1 parent 48fd6ab commit 65e3a5e

9 files changed

+160
-10
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/AbstractOAuth2AuthorizationServerMetadata.java

+46-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
import java.util.Map;
2626
import java.util.function.Consumer;
2727

28+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
2829
import org.springframework.security.oauth2.server.authorization.util.SpringAuthorizationServerVersion;
2930
import org.springframework.util.Assert;
3031

@@ -48,6 +49,9 @@
4849
* @see <a target="_blank" href=
4950
* "https://datatracker.ietf.org/doc/html/rfc8705#section-3.3">3.3 Mutual-TLS Client
5051
* Certificate-Bound Access Tokens Metadata</a>
52+
* @see <a target="_blank" href=
53+
* "https://datatracker.ietf.org/doc/html/rfc9449#section-5.1">5.1 OAuth 2.0 Demonstrating
54+
* Proof of Possession (DPoP) Metadata</a>
5155
*/
5256
public abstract class AbstractOAuth2AuthorizationServerMetadata
5357
implements OAuth2AuthorizationServerMetadataClaimAccessor, Serializable {
@@ -379,6 +383,37 @@ public B tlsClientCertificateBoundAccessTokens(boolean tlsClientCertificateBound
379383
tlsClientCertificateBoundAccessTokens);
380384
}
381385

386+
/**
387+
* Add a {@link JwsAlgorithms JSON Web Signature (JWS) algorithm} to the
388+
* collection of {@code dpop_signing_alg_values_supported} in the resulting
389+
* {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL.
390+
* @param dPoPSigningAlgorithm the {@link JwsAlgorithms JSON Web Signature (JWS)
391+
* algorithm} supported for DPoP Proof JWTs
392+
* @return the {@link AbstractBuilder} for further configuration
393+
* @since 1.5
394+
*/
395+
public B dPoPSigningAlgorithm(String dPoPSigningAlgorithm) {
396+
addClaimToClaimList(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED,
397+
dPoPSigningAlgorithm);
398+
return getThis();
399+
}
400+
401+
/**
402+
* A {@code Consumer} of the {@link JwsAlgorithms JSON Web Signature (JWS)
403+
* algorithms} supported for DPoP Proof JWTs allowing the ability to add, replace,
404+
* or remove.
405+
* @param dPoPSigningAlgorithmsConsumer a {@code Consumer} of the
406+
* {@link JwsAlgorithms JSON Web Signature (JWS) algorithms} supported for DPoP
407+
* Proof JWTs
408+
* @return the {@link AbstractBuilder} for further configuration
409+
* @since 1.5
410+
*/
411+
public B dPoPSigningAlgorithms(Consumer<List<String>> dPoPSigningAlgorithmsConsumer) {
412+
acceptClaimValues(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED,
413+
dPoPSigningAlgorithmsConsumer);
414+
return getThis();
415+
}
416+
382417
/**
383418
* Use this claim in the resulting
384419
* {@link AbstractOAuth2AuthorizationServerMetadata}.
@@ -506,6 +541,16 @@ protected void validate() {
506541
.get(OAuth2AuthorizationServerMetadataClaimNames.CODE_CHALLENGE_METHODS_SUPPORTED),
507542
"codeChallengeMethods cannot be empty");
508543
}
544+
if (getClaims()
545+
.get(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED) != null) {
546+
Assert.isInstanceOf(List.class,
547+
getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED),
548+
"dPoPSigningAlgorithms must be of type List");
549+
Assert.notEmpty(
550+
(List<?>) getClaims()
551+
.get(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED),
552+
"dPoPSigningAlgorithms cannot be empty");
553+
}
509554
}
510555

511556
@SuppressWarnings("unchecked")

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationServerMetadataClaimAccessor.java

+16-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
1919
import java.util.List;
2020

2121
import org.springframework.security.oauth2.core.ClaimAccessor;
22+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
2223

2324
/**
2425
* A {@link ClaimAccessor} for the "claims" an Authorization Server describes about its
@@ -40,6 +41,9 @@
4041
* @see <a target="_blank" href=
4142
* "https://datatracker.ietf.org/doc/html/rfc8705#section-3.3">3.3 Mutual-TLS Client
4243
* Certificate-Bound Access Tokens Metadata</a>
44+
* @see <a target="_blank" href=
45+
* "https://datatracker.ietf.org/doc/html/rfc9449#section-5.1">5.1 OAuth 2.0 Demonstrating
46+
* Proof of Possession (DPoP) Metadata</a>
4347
*/
4448
public interface OAuth2AuthorizationServerMetadataClaimAccessor extends ClaimAccessor {
4549

@@ -193,4 +197,15 @@ default boolean isTlsClientCertificateBoundAccessTokens() {
193197
OAuth2AuthorizationServerMetadataClaimNames.TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS));
194198
}
195199

200+
/**
201+
* Returns the {@link JwsAlgorithms JSON Web Signature (JWS) algorithms} supported for
202+
* DPoP Proof JWTs {@code (dpop_signing_alg_values_supported)}.
203+
* @return the {@link JwsAlgorithms JSON Web Signature (JWS) algorithms} supported for
204+
* DPoP Proof JWTs
205+
* @since 1.5
206+
*/
207+
default List<String> getDPoPSigningAlgorithms() {
208+
return getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED);
209+
}
210+
196211
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationServerMetadataClaimNames.java

+13-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,6 +15,8 @@
1515
*/
1616
package org.springframework.security.oauth2.server.authorization;
1717

18+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
19+
1820
/**
1921
* The names of the "claims" an Authorization Server describes about its configuration,
2022
* used in OAuth 2.0 Authorization Server Metadata and OpenID Connect Discovery 1.0.
@@ -32,6 +34,9 @@
3234
* @see <a target="_blank" href=
3335
* "https://datatracker.ietf.org/doc/html/rfc8705#section-3.3">3.3 Mutual-TLS Client
3436
* Certificate-Bound Access Tokens Metadata</a>
37+
* @see <a target="_blank" href=
38+
* "https://datatracker.ietf.org/doc/html/rfc9449#section-5.1">5.1 OAuth 2.0 Demonstrating
39+
* Proof of Possession (DPoP) Metadata</a>
3540
*/
3641
public class OAuth2AuthorizationServerMetadataClaimNames {
3742

@@ -130,6 +135,13 @@ public class OAuth2AuthorizationServerMetadataClaimNames {
130135
*/
131136
public static final String TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS = "tls_client_certificate_bound_access_tokens";
132137

138+
/**
139+
* {@code dpop_signing_alg_values_supported} - the {@link JwsAlgorithms JSON Web
140+
* Signature (JWS) algorithms} supported for DPoP Proof JWTs
141+
* @since 1.5
142+
*/
143+
public static final String DPOP_SIGNING_ALG_VALUES_SUPPORTED = "dpop_signing_alg_values_supported";
144+
133145
protected OAuth2AuthorizationServerMetadataClaimNames() {
134146
}
135147

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/http/converter/OAuth2AuthorizationServerMetadataHttpMessageConverter.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -169,6 +169,8 @@ private OAuth2AuthorizationServerMetadataConverter() {
169169
collectionStringConverter);
170170
claimConverters.put(OAuth2AuthorizationServerMetadataClaimNames.CODE_CHALLENGE_METHODS_SUPPORTED,
171171
collectionStringConverter);
172+
claimConverters.put(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED,
173+
collectionStringConverter);
172174
this.claimTypeConverter = new ClaimTypeConverter(claimConverters);
173175
}
174176

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java

+17-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -31,6 +31,7 @@
3131
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
3232
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationResponseType;
3333
import org.springframework.security.oauth2.core.oidc.OidcScopes;
34+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
3435
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
3536
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
3637
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
@@ -118,6 +119,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
118119
.tokenIntrospectionEndpointAuthenticationMethods(clientAuthenticationMethods())
119120
.codeChallengeMethod("S256")
120121
.tlsClientCertificateBoundAccessTokens(true)
122+
.dPoPSigningAlgorithms(dPoPSigningAlgorithms())
121123
.subjectType("public")
122124
.idTokenSigningAlgorithm(SignatureAlgorithm.RS256.getName())
123125
.scope(OidcScopes.OPENID);
@@ -151,6 +153,20 @@ private static Consumer<List<String>> clientAuthenticationMethods() {
151153
};
152154
}
153155

156+
private static Consumer<List<String>> dPoPSigningAlgorithms() {
157+
return (algs) -> {
158+
algs.add(JwsAlgorithms.RS256);
159+
algs.add(JwsAlgorithms.RS384);
160+
algs.add(JwsAlgorithms.RS512);
161+
algs.add(JwsAlgorithms.PS256);
162+
algs.add(JwsAlgorithms.PS384);
163+
algs.add(JwsAlgorithms.PS512);
164+
algs.add(JwsAlgorithms.ES256);
165+
algs.add(JwsAlgorithms.ES384);
166+
algs.add(JwsAlgorithms.ES512);
167+
};
168+
}
169+
154170
private static String asUrl(String issuer, String endpoint) {
155171
return UriComponentsBuilder.fromUriString(issuer).path(endpoint).build().toUriString();
156172
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java

+18-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
3030
import org.springframework.security.oauth2.core.AuthorizationGrantType;
3131
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
3232
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationResponseType;
33+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
3334
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServerMetadata;
3435
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
3536
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
@@ -115,7 +116,8 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
115116
.tokenIntrospectionEndpoint(asUrl(issuer, authorizationServerSettings.getTokenIntrospectionEndpoint()))
116117
.tokenIntrospectionEndpointAuthenticationMethods(clientAuthenticationMethods())
117118
.codeChallengeMethod("S256")
118-
.tlsClientCertificateBoundAccessTokens(true);
119+
.tlsClientCertificateBoundAccessTokens(true)
120+
.dPoPSigningAlgorithms(dPoPSigningAlgorithms());
119121

120122
this.authorizationServerMetadataCustomizer.accept(authorizationServerMetadata);
121123

@@ -146,6 +148,20 @@ private static Consumer<List<String>> clientAuthenticationMethods() {
146148
};
147149
}
148150

151+
private static Consumer<List<String>> dPoPSigningAlgorithms() {
152+
return (algs) -> {
153+
algs.add(JwsAlgorithms.RS256);
154+
algs.add(JwsAlgorithms.RS384);
155+
algs.add(JwsAlgorithms.RS512);
156+
algs.add(JwsAlgorithms.PS256);
157+
algs.add(JwsAlgorithms.PS384);
158+
algs.add(JwsAlgorithms.PS512);
159+
algs.add(JwsAlgorithms.ES256);
160+
algs.add(JwsAlgorithms.ES384);
161+
algs.add(JwsAlgorithms.ES512);
162+
};
163+
}
164+
149165
private static String asUrl(String issuer, String endpoint) {
150166
return UriComponentsBuilder.fromUriString(issuer).path(endpoint).toUriString();
151167
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationServerMetadataTests.java

+41-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424
import org.junit.jupiter.api.Test;
2525

2626
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
27+
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
2728
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServerMetadata.Builder;
2829

2930
import static org.assertj.core.api.Assertions.assertThat;
@@ -63,6 +64,8 @@ public void buildWhenAllClaimsProvidedThenCreated() {
6364
.tokenIntrospectionEndpointAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue())
6465
.codeChallengeMethod("S256")
6566
.tlsClientCertificateBoundAccessTokens(true)
67+
.dPoPSigningAlgorithm(JwsAlgorithms.RS256)
68+
.dPoPSigningAlgorithm(JwsAlgorithms.ES256)
6669
.claim("a-claim", "a-value")
6770
.build();
6871

@@ -87,6 +90,8 @@ public void buildWhenAllClaimsProvidedThenCreated() {
8790
.containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
8891
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactly("S256");
8992
assertThat(authorizationServerMetadata.isTlsClientCertificateBoundAccessTokens()).isTrue();
93+
assertThat(authorizationServerMetadata.getDPoPSigningAlgorithms()).containsExactly(JwsAlgorithms.RS256,
94+
JwsAlgorithms.ES256);
9095
assertThat(authorizationServerMetadata.getClaimAsString("a-claim")).isEqualTo("a-value");
9196
}
9297

@@ -113,6 +118,7 @@ public void buildWhenOnlyRequiredClaimsProvidedThenCreated() {
113118
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpoint()).isNull();
114119
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpointAuthenticationMethods()).isNull();
115120
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).isNull();
121+
assertThat(authorizationServerMetadata.getDPoPSigningAlgorithms()).isNull();
116122
}
117123

118124
@Test
@@ -152,6 +158,7 @@ public void withClaimsWhenClaimsProvidedThenCreated() {
152158
.isEqualTo(url("https://example.com/oauth2/introspect"));
153159
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpointAuthenticationMethods()).isNull();
154160
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).isNull();
161+
assertThat(authorizationServerMetadata.getDPoPSigningAlgorithms()).isNull();
155162
assertThat(authorizationServerMetadata.getClaimAsString("some-claim")).isEqualTo("some-value");
156163
}
157164

@@ -191,6 +198,7 @@ public void withClaimsWhenClaimsWithUrlsProvidedThenCreated() {
191198
.isEqualTo(url("https://example.com/oauth2/introspect"));
192199
assertThat(authorizationServerMetadata.getTokenIntrospectionEndpointAuthenticationMethods()).isNull();
193200
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).isNull();
201+
assertThat(authorizationServerMetadata.getDPoPSigningAlgorithms()).isNull();
194202
assertThat(authorizationServerMetadata.getClaimAsString("some-claim")).isEqualTo("some-value");
195203
}
196204

@@ -536,6 +544,38 @@ public void buildWhenCodeChallengeMethodsAddingOrRemovingThenCorrectValues() {
536544
assertThat(authorizationServerMetadata.getCodeChallengeMethods()).containsExactly("some-authentication-method");
537545
}
538546

547+
@Test
548+
public void buildWhenDPoPSigningAlgorithmsNotListThenThrowIllegalArgumentException() {
549+
Builder builder = this.minimalBuilder.claims((claims) -> claims
550+
.put(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED, "not-a-list"));
551+
552+
assertThatIllegalArgumentException().isThrownBy(builder::build)
553+
.withMessageStartingWith("dPoPSigningAlgorithms must be of type List");
554+
}
555+
556+
@Test
557+
public void buildWhenDPoPSigningAlgorithmsEmptyListThenThrowIllegalArgumentException() {
558+
Builder builder = this.minimalBuilder.claims(
559+
(claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.DPOP_SIGNING_ALG_VALUES_SUPPORTED,
560+
Collections.emptyList()));
561+
562+
assertThatIllegalArgumentException().isThrownBy(builder::build)
563+
.withMessage("dPoPSigningAlgorithms cannot be empty");
564+
}
565+
566+
@Test
567+
public void buildWhenDPoPSigningAlgorithmsAddingOrRemovingThenCorrectValues() {
568+
OAuth2AuthorizationServerMetadata authorizationServerMetadata = this.minimalBuilder
569+
.dPoPSigningAlgorithm(JwsAlgorithms.RS256)
570+
.dPoPSigningAlgorithms((algs) -> {
571+
algs.clear();
572+
algs.add(JwsAlgorithms.ES256);
573+
})
574+
.build();
575+
576+
assertThat(authorizationServerMetadata.getDPoPSigningAlgorithms()).containsExactly(JwsAlgorithms.ES256);
577+
}
578+
539579
@Test
540580
public void claimWhenNameNullThenThrowIllegalArgumentException() {
541581
assertThatIllegalArgumentException()

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilterTests.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -148,6 +148,8 @@ public void doFilterWhenConfigurationRequestThenConfigurationResponse() throws E
148148
"\"introspection_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\",\"tls_client_auth\",\"self_signed_tls_client_auth\"]");
149149
assertThat(providerConfigurationResponse).contains("\"code_challenge_methods_supported\":[\"S256\"]");
150150
assertThat(providerConfigurationResponse).contains("\"tls_client_certificate_bound_access_tokens\":true");
151+
assertThat(providerConfigurationResponse).contains(
152+
"\"dpop_signing_alg_values_supported\":[\"RS256\",\"RS384\",\"RS512\",\"PS256\",\"PS384\",\"PS512\",\"ES256\",\"ES384\",\"ES512\"]");
151153
assertThat(providerConfigurationResponse).contains("\"subject_types_supported\":[\"public\"]");
152154
assertThat(providerConfigurationResponse).contains("\"id_token_signing_alg_values_supported\":[\"RS256\"]");
153155
assertThat(providerConfigurationResponse).contains("\"userinfo_endpoint\":\"https://example.com/userinfo\"");

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilterTests.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2024 the original author or authors.
2+
* Copyright 2020-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -145,6 +145,8 @@ public void doFilterWhenAuthorizationServerMetadataRequestThenMetadataResponse()
145145
"\"introspection_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\",\"tls_client_auth\",\"self_signed_tls_client_auth\"]");
146146
assertThat(authorizationServerMetadataResponse).contains("\"code_challenge_methods_supported\":[\"S256\"]");
147147
assertThat(authorizationServerMetadataResponse).contains("\"tls_client_certificate_bound_access_tokens\":true");
148+
assertThat(authorizationServerMetadataResponse).contains(
149+
"\"dpop_signing_alg_values_supported\":[\"RS256\",\"RS384\",\"RS512\",\"PS256\",\"PS384\",\"PS512\",\"ES256\",\"ES384\",\"ES512\"]");
148150
}
149151

150152
@Test

0 commit comments

Comments
 (0)