Federation: Validation of metadata in entity statement

This question should be read in the light of conformance testing of federation entities:

Let's say that we've got an entity statement that contains the following metadata:

{
  "federation_entity": {
    "federation_fetch_endpoint": "https://example.com/fetch",
    "federation_list_endpoint": "https://example.com/list"
  },
  "oauth_authorization_server": {},
  "openid_relying_party": {}
}

federation_entity is valid, since all of its properties are optional. But what about oauth_authorization_server and openid_relying_party?

On one hand, the spec says that

When an Entity participates in a federation or federations with one or more Entity Types, its Entity Configuration MUST contain a metadata claim with JSON object values for each of the corresponding Entity Type Identifiers, even if the values are the empty JSON object {}

but on the other hand, if we take openid_relying_party as an example, it says

All parameters defined in Section 2 of OpenID Connect Dynamic Client Registration 1.0 [OpenID.Registration] and Section 5.2 are applicable, as well as additional parameters registered in the IANA "OAuth Dynamic Client Registration Metadata" registry [IANA.OAuth.Parameters].

But what does “applicable” mean? Does it mean that all of the properties and their optionality (or lack thereof) as defined in the DCR spec apply, meaning that we should run the same set of verifications that we do for RP DCR client registration metadata, or does it mean that the properties in the DCR spec may occur inside this metadata section, but are not subject to any validation rules?

If you could please enlighten me a little bit in this matter, that would be helpful.

Edit: I left out the little detail that client_registration_types is required in the openid_relying_party metadata section, but I guess that isn’t really relevant to the question anyway and that the description above explains it sufficiently as it is.

Comments (4)