"shall additionally send duplicates of the parameters/values using the OAuth 2.0 request syntax where required by the OAuth specification" is vague

[Joseph Heenan]

FAPI part 2 id 2 says:

shall additionally send duplicates of the parameters/values using the OAuth 2.0 request syntax where required by the OAuth specification

This is a bit vague (which I apologise for as I think I wrote it...) and I've found that in practice people are interpreting it in different ways.

e.g. oauth2 says the redirect_uri is optional, but then explanatory text in the oauth2 standard means it's not really optional.

I suggest we just explicitly enumerate the parameters that need to be duplicated outside the request object.

I think they're probably:

1. response_type (required by https://tools.ietf.org/html/rfc6749#section-4.1.1 )
2. client_id (required by https://tools.ietf.org/html/rfc6749#section-4.1.1 )
3. redirect_uri (required by rfc6749 but only if multiple redirect urls registered; always required by OIDCC)
4. scope (optional in oauth2 but required in OIDCC); I think strictly the ID2 text doesn't require scope to be sent outside the request object but I have seen people interpret it this way).

[Joseph Heenan]

https://openid.net/specs/openid-connect-core-1_0.html#RequestObject says:

So that the request is a valid OAuth 2.0 Authorization Request, values for the response_type and client_id parameters MUST be included using the OAuth 2.0 request syntax, since they are REQUIRED by OAuth 2.0. The values for these parameters MUST match those in the Request Object, if present.

Even if a scope parameter is present in the Request Object value, a scope parameter MUST always be passed using the OAuth 2.0 request syntax containing the openid scope value to indicate to the underlying OAuth 2.0 logic that this is an OpenID Connect request.

[Brian Campbell]

redirect_uri should not be one of the ones that requires duplication.

[Dave Tonge]

Merged in josephheenan/fapi/clarify-dup-parameters (pull request #97)

FAPI-RW: Clarify the clause about duplicate request parameters

The current clause was being interpretted in different ways by different implementations; to help interoperability, we now spell out exactly what is meant.

closes #217

Approved-by: Brian Campbell [e-mail] Approved-by: Dave Tonge [e-mail]

→ <<cset 74754ca7cde8>>