rodauth-ciba 0.1.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +37 -1
- data/README.md +4 -4
- data/docs/api.md +8 -5
- data/docs/authentication-claims.md +11 -1
- data/docs/ciba-conformance.md +58 -0
- data/docs/ciba-core-requirements.json +3537 -0
- data/docs/claims.md +5 -1
- data/docs/max-age.md +3 -1
- data/docs/operations.md +28 -1
- data/docs/pairwise.md +20 -4
- data/docs/refresh-tokens.md +32 -0
- data/docs/release-readiness.md +22 -3
- data/docs/release-validation.md +5 -0
- data/docs/requirements-audit-current.json +2 -1
- data/docs/requirements-audit-current.md +2 -0
- data/examples/extensions_smoke.rb +18 -1
- data/lib/rodauth/ciba/pairwise.rb +7 -3
- data/lib/rodauth/ciba/registration.rb +4 -0
- data/lib/rodauth/ciba/version.rb +1 -1
- data/lib/rodauth/features/ciba.rb +195 -19
- metadata +4 -2
|
@@ -0,0 +1,3537 @@
|
|
|
1
|
+
{
|
|
2
|
+
"title": "CIBA Core final requirement ledger for local conformance improvements",
|
|
3
|
+
"as_of": "2026-10-11",
|
|
4
|
+
"base_sha": "74ccc85e4f7af9596fec2b965bd43eed0ff708bc",
|
|
5
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html",
|
|
6
|
+
"scope": "Poll plus advertised opt-in ping, hints, signing and user codes; push excluded; pairwise and DCR experimental. OIDC claims/max_age are separately identified extensions.",
|
|
7
|
+
"method": "159 inherited authored CIBA rows plus five conditional OIDC rows cover the current inventory. Not an official denominator, certification or exhaustive proof. Local regression results do not discharge application gates, optional combinations or official-suite acceptance.",
|
|
8
|
+
"levels_note": "Normative details distinguish capitalized RFC2119 words from lowercase descriptive guidance; REQUIRED parameter semantics are retained. Compound rows may contain both definitions and normative requirements.",
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "CIBA-001",
|
|
12
|
+
"section": "4",
|
|
13
|
+
"requirement": "Use urn:openid:params:grant-type:ciba as the CIBA extension grant identifier.",
|
|
14
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
15
|
+
"normative_level": "definition_or_guidance",
|
|
16
|
+
"normative_detail": "Specification definition (fixed grant value; no MUST/REQUIRED keyword)",
|
|
17
|
+
"conditional": false,
|
|
18
|
+
"feature": "core",
|
|
19
|
+
"responsibility": "gem",
|
|
20
|
+
"status": "code_reviewed",
|
|
21
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
22
|
+
"code_symbols": [
|
|
23
|
+
"ciba_metadata",
|
|
24
|
+
"oauth_grant_types_supported",
|
|
25
|
+
"ciba_client_eligible?",
|
|
26
|
+
"post_configure"
|
|
27
|
+
],
|
|
28
|
+
"grouped_test_files": [
|
|
29
|
+
"test/ciba_protocol_test.rb",
|
|
30
|
+
"test/ciba_security_test.rb",
|
|
31
|
+
"test/ciba_registration_test.rb"
|
|
32
|
+
],
|
|
33
|
+
"historical_status_not_current_evidence": "verified",
|
|
34
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
35
|
+
},
|
|
36
|
+
{
|
|
37
|
+
"id": "CIBA-002",
|
|
38
|
+
"section": "4",
|
|
39
|
+
"requirement": "Publish required backchannel_token_delivery_modes_supported as an array of actually supported poll/ping/push modes.",
|
|
40
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
41
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
42
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
43
|
+
"conditional": false,
|
|
44
|
+
"feature": "core",
|
|
45
|
+
"responsibility": "gem",
|
|
46
|
+
"status": "code_reviewed",
|
|
47
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
48
|
+
"code_symbols": [
|
|
49
|
+
"ciba_metadata",
|
|
50
|
+
"oauth_grant_types_supported",
|
|
51
|
+
"ciba_client_eligible?",
|
|
52
|
+
"post_configure"
|
|
53
|
+
],
|
|
54
|
+
"grouped_test_files": [
|
|
55
|
+
"test/ciba_protocol_test.rb",
|
|
56
|
+
"test/ciba_security_test.rb",
|
|
57
|
+
"test/ciba_registration_test.rb"
|
|
58
|
+
],
|
|
59
|
+
"historical_status_not_current_evidence": "verified",
|
|
60
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
"id": "CIBA-003",
|
|
64
|
+
"section": "4",
|
|
65
|
+
"requirement": "Publish required backchannel_authentication_endpoint as the actual Backchannel Endpoint URL.",
|
|
66
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
67
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
68
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
69
|
+
"conditional": false,
|
|
70
|
+
"feature": "core",
|
|
71
|
+
"responsibility": "gem",
|
|
72
|
+
"status": "code_reviewed",
|
|
73
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
74
|
+
"code_symbols": [
|
|
75
|
+
"ciba_metadata",
|
|
76
|
+
"oauth_grant_types_supported",
|
|
77
|
+
"ciba_client_eligible?",
|
|
78
|
+
"post_configure"
|
|
79
|
+
],
|
|
80
|
+
"grouped_test_files": [
|
|
81
|
+
"test/ciba_protocol_test.rb",
|
|
82
|
+
"test/ciba_security_test.rb",
|
|
83
|
+
"test/ciba_registration_test.rb"
|
|
84
|
+
],
|
|
85
|
+
"historical_status_not_current_evidence": "verified",
|
|
86
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "CIBA-004",
|
|
90
|
+
"section": "4",
|
|
91
|
+
"requirement": "Only advertise backchannel_authentication_request_signing_alg_values_supported when signed requests are supported; omission means unsupported.",
|
|
92
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
93
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
94
|
+
"normative_detail": "任意（OP may omit; absence says unsupported）",
|
|
95
|
+
"conditional": true,
|
|
96
|
+
"feature": "core",
|
|
97
|
+
"responsibility": "gem",
|
|
98
|
+
"status": "code_reviewed",
|
|
99
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
100
|
+
"code_symbols": [
|
|
101
|
+
"ciba_metadata",
|
|
102
|
+
"oauth_grant_types_supported",
|
|
103
|
+
"ciba_client_eligible?",
|
|
104
|
+
"post_configure"
|
|
105
|
+
],
|
|
106
|
+
"grouped_test_files": [
|
|
107
|
+
"test/ciba_protocol_test.rb",
|
|
108
|
+
"test/ciba_security_test.rb",
|
|
109
|
+
"test/ciba_registration_test.rb"
|
|
110
|
+
],
|
|
111
|
+
"historical_status_not_current_evidence": "verified",
|
|
112
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
113
|
+
},
|
|
114
|
+
{
|
|
115
|
+
"id": "CIBA-005",
|
|
116
|
+
"section": "4",
|
|
117
|
+
"requirement": "Publish user_code support truthfully; absent backchannel_user_code_parameter_supported defaults to false.",
|
|
118
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
119
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
120
|
+
"normative_detail": "任意（OP may omit; omitted means false）",
|
|
121
|
+
"conditional": false,
|
|
122
|
+
"feature": "core",
|
|
123
|
+
"responsibility": "gem",
|
|
124
|
+
"status": "code_reviewed",
|
|
125
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
126
|
+
"code_symbols": [
|
|
127
|
+
"ciba_metadata",
|
|
128
|
+
"oauth_grant_types_supported",
|
|
129
|
+
"ciba_client_eligible?",
|
|
130
|
+
"post_configure"
|
|
131
|
+
],
|
|
132
|
+
"grouped_test_files": [
|
|
133
|
+
"test/ciba_protocol_test.rb",
|
|
134
|
+
"test/ciba_security_test.rb",
|
|
135
|
+
"test/ciba_registration_test.rb"
|
|
136
|
+
],
|
|
137
|
+
"historical_status_not_current_evidence": "verified",
|
|
138
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
139
|
+
},
|
|
140
|
+
{
|
|
141
|
+
"id": "CIBA-006",
|
|
142
|
+
"section": "4",
|
|
143
|
+
"requirement": "Include the CIBA grant in grant_types_supported when supporting poll or ping.",
|
|
144
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
145
|
+
"normative_level": "definition_or_guidance",
|
|
146
|
+
"normative_detail": "仕様定義（poll/pingのgrant_types_supported。MUSTという語ではない）",
|
|
147
|
+
"conditional": true,
|
|
148
|
+
"feature": "core",
|
|
149
|
+
"responsibility": "gem",
|
|
150
|
+
"status": "code_reviewed",
|
|
151
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
152
|
+
"code_symbols": [
|
|
153
|
+
"ciba_metadata",
|
|
154
|
+
"oauth_grant_types_supported",
|
|
155
|
+
"ciba_client_eligible?",
|
|
156
|
+
"post_configure"
|
|
157
|
+
],
|
|
158
|
+
"grouped_test_files": [
|
|
159
|
+
"test/ciba_protocol_test.rb",
|
|
160
|
+
"test/ciba_security_test.rb",
|
|
161
|
+
"test/ciba_registration_test.rb"
|
|
162
|
+
],
|
|
163
|
+
"historical_status_not_current_evidence": "verified",
|
|
164
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "CIBA-007",
|
|
168
|
+
"section": "4",
|
|
169
|
+
"requirement": "Backchannel authentication methods match token_endpoint_auth_methods_supported.",
|
|
170
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
171
|
+
"normative_level": "definition_or_guidance",
|
|
172
|
+
"normative_detail": "Specification definition (metadata consistency; no MUST/REQUIRED keyword)",
|
|
173
|
+
"conditional": false,
|
|
174
|
+
"feature": "core",
|
|
175
|
+
"responsibility": "gem + upstream",
|
|
176
|
+
"status": "code_reviewed",
|
|
177
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
178
|
+
"code_symbols": [
|
|
179
|
+
"ciba_metadata",
|
|
180
|
+
"oauth_grant_types_supported",
|
|
181
|
+
"ciba_client_eligible?",
|
|
182
|
+
"post_configure"
|
|
183
|
+
],
|
|
184
|
+
"grouped_test_files": [
|
|
185
|
+
"test/ciba_protocol_test.rb",
|
|
186
|
+
"test/ciba_security_test.rb",
|
|
187
|
+
"test/ciba_registration_test.rb"
|
|
188
|
+
],
|
|
189
|
+
"historical_status_not_current_evidence": "verified",
|
|
190
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
191
|
+
},
|
|
192
|
+
{
|
|
193
|
+
"id": "CIBA-008",
|
|
194
|
+
"section": "4",
|
|
195
|
+
"requirement": "When applicable Backchannel authentication signing algorithms match token_endpoint_auth_signing_alg_values_supported.",
|
|
196
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
197
|
+
"normative_level": "definition_or_guidance",
|
|
198
|
+
"normative_detail": "Conditional specification definition (metadata consistency; no MUST/REQUIRED keyword)",
|
|
199
|
+
"conditional": true,
|
|
200
|
+
"feature": "core",
|
|
201
|
+
"responsibility": "gem + upstream",
|
|
202
|
+
"status": "code_reviewed",
|
|
203
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
204
|
+
"code_symbols": [
|
|
205
|
+
"ciba_metadata",
|
|
206
|
+
"oauth_grant_types_supported",
|
|
207
|
+
"ciba_client_eligible?",
|
|
208
|
+
"post_configure"
|
|
209
|
+
],
|
|
210
|
+
"grouped_test_files": [
|
|
211
|
+
"test/ciba_protocol_test.rb",
|
|
212
|
+
"test/ciba_security_test.rb",
|
|
213
|
+
"test/ciba_registration_test.rb"
|
|
214
|
+
],
|
|
215
|
+
"historical_status_not_current_evidence": "verified",
|
|
216
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
217
|
+
},
|
|
218
|
+
{
|
|
219
|
+
"id": "CIBA-009",
|
|
220
|
+
"section": "4",
|
|
221
|
+
"requirement": "Require a registered single backchannel_token_delivery_mode from poll/ping/push for a CIBA client.",
|
|
222
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
223
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
224
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
225
|
+
"conditional": false,
|
|
226
|
+
"feature": "core",
|
|
227
|
+
"responsibility": "gem",
|
|
228
|
+
"status": "code_reviewed",
|
|
229
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
230
|
+
"code_symbols": [
|
|
231
|
+
"ciba_metadata",
|
|
232
|
+
"oauth_grant_types_supported",
|
|
233
|
+
"ciba_client_eligible?",
|
|
234
|
+
"post_configure"
|
|
235
|
+
],
|
|
236
|
+
"grouped_test_files": [
|
|
237
|
+
"test/ciba_protocol_test.rb",
|
|
238
|
+
"test/ciba_security_test.rb",
|
|
239
|
+
"test/ciba_registration_test.rb"
|
|
240
|
+
],
|
|
241
|
+
"historical_status_not_current_evidence": "verified",
|
|
242
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "CIBA-010",
|
|
246
|
+
"section": "4",
|
|
247
|
+
"requirement": "Poll/ping clients register the CIBA grant in grant_types; enforce eligibility before accepting their requests.",
|
|
248
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
249
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
250
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
251
|
+
"conditional": false,
|
|
252
|
+
"feature": "core",
|
|
253
|
+
"responsibility": "gem",
|
|
254
|
+
"status": "code_reviewed",
|
|
255
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
256
|
+
"code_symbols": [
|
|
257
|
+
"ciba_metadata",
|
|
258
|
+
"oauth_grant_types_supported",
|
|
259
|
+
"ciba_client_eligible?",
|
|
260
|
+
"post_configure"
|
|
261
|
+
],
|
|
262
|
+
"grouped_test_files": [
|
|
263
|
+
"test/ciba_protocol_test.rb",
|
|
264
|
+
"test/ciba_security_test.rb",
|
|
265
|
+
"test/ciba_registration_test.rb"
|
|
266
|
+
],
|
|
267
|
+
"historical_status_not_current_evidence": "verified",
|
|
268
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
269
|
+
},
|
|
270
|
+
{
|
|
271
|
+
"id": "CIBA-011",
|
|
272
|
+
"section": "4",
|
|
273
|
+
"requirement": "Ping/push clients register an HTTPS backchannel_client_notification_endpoint.",
|
|
274
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
275
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
276
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
277
|
+
"conditional": true,
|
|
278
|
+
"feature": "core",
|
|
279
|
+
"responsibility": "app",
|
|
280
|
+
"status": "application_contract",
|
|
281
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
282
|
+
"code_symbols": [],
|
|
283
|
+
"grouped_test_files": [
|
|
284
|
+
"test/ciba_protocol_test.rb",
|
|
285
|
+
"test/ciba_security_test.rb",
|
|
286
|
+
"test/ciba_registration_test.rb"
|
|
287
|
+
],
|
|
288
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
289
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
290
|
+
},
|
|
291
|
+
{
|
|
292
|
+
"id": "CIBA-012",
|
|
293
|
+
"section": "4",
|
|
294
|
+
"requirement": "Clients intending signed authentication requests register the signature algorithm; omission means unsigned requests.",
|
|
295
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
296
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
297
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
298
|
+
"conditional": true,
|
|
299
|
+
"feature": "signed_requests",
|
|
300
|
+
"responsibility": "gem",
|
|
301
|
+
"status": "code_reviewed",
|
|
302
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
303
|
+
"code_symbols": [],
|
|
304
|
+
"grouped_test_files": [
|
|
305
|
+
"test/ciba_protocol_test.rb",
|
|
306
|
+
"test/ciba_security_test.rb",
|
|
307
|
+
"test/ciba_registration_test.rb"
|
|
308
|
+
],
|
|
309
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
310
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
311
|
+
},
|
|
312
|
+
{
|
|
313
|
+
"id": "CIBA-013",
|
|
314
|
+
"section": "4",
|
|
315
|
+
"requirement": "Respect backchannel_user_code_parameter only when OP user_code support is enabled; omitted value defaults false.",
|
|
316
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
317
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
318
|
+
"normative_detail": "Optional client metadata (OPTIONAL; only applies when OP support is true)",
|
|
319
|
+
"conditional": true,
|
|
320
|
+
"feature": "user_code",
|
|
321
|
+
"responsibility": "gem",
|
|
322
|
+
"status": "code_reviewed",
|
|
323
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
324
|
+
"code_symbols": [],
|
|
325
|
+
"grouped_test_files": [
|
|
326
|
+
"test/ciba_protocol_test.rb",
|
|
327
|
+
"test/ciba_security_test.rb",
|
|
328
|
+
"test/ciba_registration_test.rb"
|
|
329
|
+
],
|
|
330
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
331
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
332
|
+
},
|
|
333
|
+
{
|
|
334
|
+
"id": "CIBA-014",
|
|
335
|
+
"section": "4",
|
|
336
|
+
"requirement": "Use each client's registered token_endpoint_auth_method for both Backchannel and Token endpoints.",
|
|
337
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
338
|
+
"normative_level": "definition_or_guidance",
|
|
339
|
+
"normative_detail": "Specification definition (registered method; no MUST/REQUIRED keyword)",
|
|
340
|
+
"conditional": false,
|
|
341
|
+
"feature": "core",
|
|
342
|
+
"responsibility": "gem + upstream",
|
|
343
|
+
"status": "code_reviewed",
|
|
344
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
345
|
+
"code_symbols": [
|
|
346
|
+
"ciba_metadata",
|
|
347
|
+
"oauth_grant_types_supported",
|
|
348
|
+
"ciba_client_eligible?",
|
|
349
|
+
"post_configure"
|
|
350
|
+
],
|
|
351
|
+
"grouped_test_files": [
|
|
352
|
+
"test/ciba_protocol_test.rb",
|
|
353
|
+
"test/ciba_security_test.rb",
|
|
354
|
+
"test/ciba_registration_test.rb"
|
|
355
|
+
],
|
|
356
|
+
"historical_status_not_current_evidence": "verified",
|
|
357
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
358
|
+
},
|
|
359
|
+
{
|
|
360
|
+
"id": "CIBA-015",
|
|
361
|
+
"section": "4",
|
|
362
|
+
"requirement": "For poll/ping pairwise subjects use jwks_uri or sector_identifier_uri instead of redirect_uri to determine sector.",
|
|
363
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
364
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
365
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
366
|
+
"conditional": true,
|
|
367
|
+
"feature": "core",
|
|
368
|
+
"responsibility": "gem",
|
|
369
|
+
"status": "experimental_unverified",
|
|
370
|
+
"acceptance_gate": "Pairwise/DCR disabled by default; outside supported release",
|
|
371
|
+
"code_symbols": [],
|
|
372
|
+
"grouped_test_files": [
|
|
373
|
+
"test/ciba_protocol_test.rb",
|
|
374
|
+
"test/ciba_security_test.rb",
|
|
375
|
+
"test/ciba_registration_test.rb"
|
|
376
|
+
],
|
|
377
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
378
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
379
|
+
},
|
|
380
|
+
{
|
|
381
|
+
"id": "CIBA-016",
|
|
382
|
+
"section": "4",
|
|
383
|
+
"requirement": "For pairwise poll/ping dynamic registration validate jwks_uri and its inclusion in an explicit sector_identifier_uri document.",
|
|
384
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
385
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
386
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
387
|
+
"conditional": true,
|
|
388
|
+
"feature": "core",
|
|
389
|
+
"responsibility": "gem",
|
|
390
|
+
"status": "experimental_unverified",
|
|
391
|
+
"acceptance_gate": "Pairwise/DCR disabled by default; outside supported release",
|
|
392
|
+
"code_symbols": [],
|
|
393
|
+
"grouped_test_files": [
|
|
394
|
+
"test/ciba_protocol_test.rb",
|
|
395
|
+
"test/ciba_security_test.rb",
|
|
396
|
+
"test/ciba_registration_test.rb"
|
|
397
|
+
],
|
|
398
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
399
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
400
|
+
},
|
|
401
|
+
{
|
|
402
|
+
"id": "CIBA-017",
|
|
403
|
+
"section": "4",
|
|
404
|
+
"requirement": "For pairwise poll/ping require proof of possession of key material associated with jwks_uri through signed requests or the specified asymmetric client authentication.",
|
|
405
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
406
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
407
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
408
|
+
"conditional": true,
|
|
409
|
+
"feature": "core",
|
|
410
|
+
"responsibility": "gem",
|
|
411
|
+
"status": "experimental_unverified",
|
|
412
|
+
"acceptance_gate": "Pairwise/DCR disabled by default; outside supported release",
|
|
413
|
+
"code_symbols": [],
|
|
414
|
+
"grouped_test_files": [
|
|
415
|
+
"test/ciba_protocol_test.rb",
|
|
416
|
+
"test/ciba_security_test.rb",
|
|
417
|
+
"test/ciba_registration_test.rb"
|
|
418
|
+
],
|
|
419
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
420
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
421
|
+
},
|
|
422
|
+
{
|
|
423
|
+
"id": "CIBA-018",
|
|
424
|
+
"section": "4",
|
|
425
|
+
"requirement": "Use notification endpoint host for push pairwise sector and check membership when explicit sector_identifier_uri is supplied.",
|
|
426
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.4",
|
|
427
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
428
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
429
|
+
"conditional": true,
|
|
430
|
+
"feature": "push",
|
|
431
|
+
"responsibility": "gem",
|
|
432
|
+
"status": "not_applicable",
|
|
433
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
434
|
+
"code_symbols": [],
|
|
435
|
+
"grouped_test_files": [
|
|
436
|
+
"test/ciba_protocol_test.rb",
|
|
437
|
+
"test/ciba_security_test.rb",
|
|
438
|
+
"test/ciba_registration_test.rb"
|
|
439
|
+
],
|
|
440
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
441
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
442
|
+
},
|
|
443
|
+
{
|
|
444
|
+
"id": "CIBA-019",
|
|
445
|
+
"section": "5",
|
|
446
|
+
"requirement": "Make authentication results available through the token endpoint in poll mode.",
|
|
447
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.5",
|
|
448
|
+
"normative_level": "definition_or_guidance",
|
|
449
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
450
|
+
"conditional": false,
|
|
451
|
+
"feature": "core",
|
|
452
|
+
"responsibility": "gem",
|
|
453
|
+
"status": "code_reviewed",
|
|
454
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
455
|
+
"code_symbols": [
|
|
456
|
+
"ciba_metadata",
|
|
457
|
+
"create_token"
|
|
458
|
+
],
|
|
459
|
+
"grouped_test_files": [
|
|
460
|
+
"test/ciba_integration_test.rb",
|
|
461
|
+
"test/ciba_ping_test.rb"
|
|
462
|
+
],
|
|
463
|
+
"historical_status_not_current_evidence": "verified",
|
|
464
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "CIBA-020",
|
|
468
|
+
"section": "5",
|
|
469
|
+
"requirement": "Notify the client then make the result available at the token endpoint in ping mode.",
|
|
470
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.5",
|
|
471
|
+
"normative_level": "definition_or_guidance",
|
|
472
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
473
|
+
"conditional": true,
|
|
474
|
+
"feature": "ping",
|
|
475
|
+
"responsibility": "gem",
|
|
476
|
+
"status": "code_reviewed",
|
|
477
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
478
|
+
"code_symbols": [],
|
|
479
|
+
"grouped_test_files": [
|
|
480
|
+
"test/ciba_integration_test.rb",
|
|
481
|
+
"test/ciba_ping_test.rb"
|
|
482
|
+
],
|
|
483
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
484
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
485
|
+
},
|
|
486
|
+
{
|
|
487
|
+
"id": "CIBA-021",
|
|
488
|
+
"section": "5",
|
|
489
|
+
"requirement": "Deliver the complete authentication result directly to the notification endpoint in push mode.",
|
|
490
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.5",
|
|
491
|
+
"normative_level": "definition_or_guidance",
|
|
492
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
493
|
+
"conditional": true,
|
|
494
|
+
"feature": "push",
|
|
495
|
+
"responsibility": "gem",
|
|
496
|
+
"status": "not_applicable",
|
|
497
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
498
|
+
"code_symbols": [],
|
|
499
|
+
"grouped_test_files": [
|
|
500
|
+
"test/ciba_integration_test.rb",
|
|
501
|
+
"test/ciba_ping_test.rb"
|
|
502
|
+
],
|
|
503
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
504
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
505
|
+
},
|
|
506
|
+
{
|
|
507
|
+
"id": "CIBA-022",
|
|
508
|
+
"section": "5",
|
|
509
|
+
"requirement": "If supporting sender-constrained tokens in push, record Backchannel key material and bind issued tokens to it.",
|
|
510
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.5",
|
|
511
|
+
"normative_level": "definition_or_guidance",
|
|
512
|
+
"normative_detail": "任意能力に対する設計指針（lowercase should）",
|
|
513
|
+
"conditional": true,
|
|
514
|
+
"feature": "push",
|
|
515
|
+
"responsibility": "gem",
|
|
516
|
+
"status": "not_applicable",
|
|
517
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
518
|
+
"code_symbols": [],
|
|
519
|
+
"grouped_test_files": [
|
|
520
|
+
"test/ciba_integration_test.rb",
|
|
521
|
+
"test/ciba_ping_test.rb"
|
|
522
|
+
],
|
|
523
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
524
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "CIBA-023",
|
|
528
|
+
"section": "7",
|
|
529
|
+
"requirement": "Require TLS for Backchannel Authentication Endpoint communication.",
|
|
530
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7",
|
|
531
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
532
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
533
|
+
"conditional": false,
|
|
534
|
+
"feature": "core",
|
|
535
|
+
"responsibility": "gem",
|
|
536
|
+
"status": "code_reviewed",
|
|
537
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
538
|
+
"code_symbols": [
|
|
539
|
+
"validate_ciba_transport!",
|
|
540
|
+
"validate_ciba_request!",
|
|
541
|
+
"backchannel_authentication route"
|
|
542
|
+
],
|
|
543
|
+
"grouped_test_files": [
|
|
544
|
+
"test/ciba_security_test.rb"
|
|
545
|
+
],
|
|
546
|
+
"historical_status_not_current_evidence": "verified",
|
|
547
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
548
|
+
},
|
|
549
|
+
{
|
|
550
|
+
"id": "CIBA-024",
|
|
551
|
+
"section": "7.1",
|
|
552
|
+
"requirement": "Accept authentication requests as HTTP POST application/x-www-form-urlencoded UTF-8 bodies.",
|
|
553
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
554
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
555
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
556
|
+
"conditional": false,
|
|
557
|
+
"feature": "core",
|
|
558
|
+
"responsibility": "gem",
|
|
559
|
+
"status": "code_reviewed",
|
|
560
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
561
|
+
"code_symbols": [
|
|
562
|
+
"validate_ciba_transport!",
|
|
563
|
+
"validate_ciba_request!",
|
|
564
|
+
"resolve_ciba_login_hint",
|
|
565
|
+
"ciba_error"
|
|
566
|
+
],
|
|
567
|
+
"grouped_test_files": [
|
|
568
|
+
"test/ciba_protocol_test.rb",
|
|
569
|
+
"test/ciba_security_test.rb",
|
|
570
|
+
"test/ciba_ping_test.rb"
|
|
571
|
+
],
|
|
572
|
+
"historical_status_not_current_evidence": "verified",
|
|
573
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
574
|
+
},
|
|
575
|
+
{
|
|
576
|
+
"id": "CIBA-025",
|
|
577
|
+
"section": "7.1",
|
|
578
|
+
"requirement": "Authenticate the client at Backchannel using its registered authentication method.",
|
|
579
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
580
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
581
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
582
|
+
"conditional": false,
|
|
583
|
+
"feature": "core",
|
|
584
|
+
"responsibility": "gem + upstream",
|
|
585
|
+
"status": "code_reviewed",
|
|
586
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
587
|
+
"code_symbols": [
|
|
588
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
589
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
590
|
+
"require_oauth_application (upstream)"
|
|
591
|
+
],
|
|
592
|
+
"grouped_test_files": [
|
|
593
|
+
"test/ciba_protocol_test.rb",
|
|
594
|
+
"test/ciba_security_test.rb",
|
|
595
|
+
"test/ciba_ping_test.rb"
|
|
596
|
+
],
|
|
597
|
+
"historical_status_not_current_evidence": "verified",
|
|
598
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
599
|
+
},
|
|
600
|
+
{
|
|
601
|
+
"id": "CIBA-026",
|
|
602
|
+
"section": "7.1",
|
|
603
|
+
"requirement": "At Backchannel accept OP issuer identifier as the audience of JWT client assertions.",
|
|
604
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
605
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
606
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
607
|
+
"conditional": false,
|
|
608
|
+
"feature": "core",
|
|
609
|
+
"responsibility": "gem + upstream",
|
|
610
|
+
"status": "code_reviewed",
|
|
611
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
612
|
+
"code_symbols": [
|
|
613
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
614
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
615
|
+
"require_oauth_application (upstream)"
|
|
616
|
+
],
|
|
617
|
+
"grouped_test_files": [
|
|
618
|
+
"test/ciba_protocol_test.rb",
|
|
619
|
+
"test/ciba_security_test.rb",
|
|
620
|
+
"test/ciba_ping_test.rb"
|
|
621
|
+
],
|
|
622
|
+
"historical_status_not_current_evidence": "verified",
|
|
623
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
624
|
+
},
|
|
625
|
+
{
|
|
626
|
+
"id": "CIBA-027",
|
|
627
|
+
"section": "7.1",
|
|
628
|
+
"requirement": "At Backchannel accept Token Endpoint URL as the audience of JWT client assertions.",
|
|
629
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
630
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
631
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
632
|
+
"conditional": false,
|
|
633
|
+
"feature": "core",
|
|
634
|
+
"responsibility": "gem + upstream",
|
|
635
|
+
"status": "code_reviewed",
|
|
636
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
637
|
+
"code_symbols": [
|
|
638
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
639
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
640
|
+
"require_oauth_application (upstream)"
|
|
641
|
+
],
|
|
642
|
+
"grouped_test_files": [
|
|
643
|
+
"test/ciba_protocol_test.rb",
|
|
644
|
+
"test/ciba_security_test.rb",
|
|
645
|
+
"test/ciba_ping_test.rb"
|
|
646
|
+
],
|
|
647
|
+
"historical_status_not_current_evidence": "verified",
|
|
648
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
649
|
+
},
|
|
650
|
+
{
|
|
651
|
+
"id": "CIBA-028",
|
|
652
|
+
"section": "7.1",
|
|
653
|
+
"requirement": "At Backchannel accept Backchannel Endpoint URL as the audience of JWT client assertions.",
|
|
654
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
655
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
656
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
657
|
+
"conditional": false,
|
|
658
|
+
"feature": "core",
|
|
659
|
+
"responsibility": "gem + upstream",
|
|
660
|
+
"status": "code_reviewed",
|
|
661
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
662
|
+
"code_symbols": [
|
|
663
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
664
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
665
|
+
"require_oauth_application (upstream)"
|
|
666
|
+
],
|
|
667
|
+
"grouped_test_files": [
|
|
668
|
+
"test/ciba_protocol_test.rb",
|
|
669
|
+
"test/ciba_security_test.rb",
|
|
670
|
+
"test/ciba_ping_test.rb"
|
|
671
|
+
],
|
|
672
|
+
"historical_status_not_current_evidence": "verified",
|
|
673
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
674
|
+
},
|
|
675
|
+
{
|
|
676
|
+
"id": "CIBA-029",
|
|
677
|
+
"section": "7.1",
|
|
678
|
+
"requirement": "Client should use the OP issuer identifier for JWT assertion audience at Backchannel.",
|
|
679
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
680
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
681
|
+
"normative_detail": "推奨（SHOULD use OP Issuer as JWT aud）",
|
|
682
|
+
"conditional": false,
|
|
683
|
+
"feature": "core",
|
|
684
|
+
"responsibility": "client",
|
|
685
|
+
"status": "client_duty",
|
|
686
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
687
|
+
"code_symbols": [],
|
|
688
|
+
"grouped_test_files": [
|
|
689
|
+
"test/ciba_protocol_test.rb",
|
|
690
|
+
"test/ciba_security_test.rb",
|
|
691
|
+
"test/ciba_ping_test.rb"
|
|
692
|
+
],
|
|
693
|
+
"historical_status_not_current_evidence": "client_only",
|
|
694
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
695
|
+
},
|
|
696
|
+
{
|
|
697
|
+
"id": "CIBA-030",
|
|
698
|
+
"section": "7.1",
|
|
699
|
+
"requirement": "Require scope in a CIBA authentication request.",
|
|
700
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
701
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
702
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
703
|
+
"conditional": false,
|
|
704
|
+
"feature": "core",
|
|
705
|
+
"responsibility": "gem",
|
|
706
|
+
"status": "code_reviewed",
|
|
707
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
708
|
+
"code_symbols": [
|
|
709
|
+
"validate_ciba_transport!",
|
|
710
|
+
"validate_ciba_request!",
|
|
711
|
+
"resolve_ciba_login_hint",
|
|
712
|
+
"ciba_error"
|
|
713
|
+
],
|
|
714
|
+
"grouped_test_files": [
|
|
715
|
+
"test/ciba_protocol_test.rb",
|
|
716
|
+
"test/ciba_security_test.rb",
|
|
717
|
+
"test/ciba_ping_test.rb"
|
|
718
|
+
],
|
|
719
|
+
"historical_status_not_current_evidence": "verified",
|
|
720
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
721
|
+
},
|
|
722
|
+
{
|
|
723
|
+
"id": "CIBA-031",
|
|
724
|
+
"section": "7.1",
|
|
725
|
+
"requirement": "Require the openid scope for the OpenID CIBA flow.",
|
|
726
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
727
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
728
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
729
|
+
"conditional": false,
|
|
730
|
+
"feature": "core",
|
|
731
|
+
"responsibility": "gem",
|
|
732
|
+
"status": "code_reviewed",
|
|
733
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
734
|
+
"code_symbols": [
|
|
735
|
+
"validate_ciba_transport!",
|
|
736
|
+
"validate_ciba_request!",
|
|
737
|
+
"resolve_ciba_login_hint",
|
|
738
|
+
"ciba_error"
|
|
739
|
+
],
|
|
740
|
+
"grouped_test_files": [
|
|
741
|
+
"test/ciba_protocol_test.rb",
|
|
742
|
+
"test/ciba_security_test.rb",
|
|
743
|
+
"test/ciba_ping_test.rb"
|
|
744
|
+
],
|
|
745
|
+
"historical_status_not_current_evidence": "verified",
|
|
746
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
747
|
+
},
|
|
748
|
+
{
|
|
749
|
+
"id": "CIBA-032",
|
|
750
|
+
"section": "7.1",
|
|
751
|
+
"requirement": "Allow authorized additional scopes such as profile/email/address/phone without treating openid as the only possible scope.",
|
|
752
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
753
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
754
|
+
"normative_detail": "任意（other scopes MAY be present）",
|
|
755
|
+
"conditional": false,
|
|
756
|
+
"feature": "core",
|
|
757
|
+
"responsibility": "gem",
|
|
758
|
+
"status": "code_reviewed",
|
|
759
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
760
|
+
"code_symbols": [
|
|
761
|
+
"validate_ciba_transport!",
|
|
762
|
+
"validate_ciba_request!",
|
|
763
|
+
"resolve_ciba_login_hint",
|
|
764
|
+
"ciba_error"
|
|
765
|
+
],
|
|
766
|
+
"grouped_test_files": [
|
|
767
|
+
"test/ciba_protocol_test.rb",
|
|
768
|
+
"test/ciba_security_test.rb",
|
|
769
|
+
"test/ciba_ping_test.rb"
|
|
770
|
+
],
|
|
771
|
+
"historical_status_not_current_evidence": "verified",
|
|
772
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
773
|
+
},
|
|
774
|
+
{
|
|
775
|
+
"id": "CIBA-033",
|
|
776
|
+
"section": "7.1",
|
|
777
|
+
"requirement": "Require client_notification_token for ping/push.",
|
|
778
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
779
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
780
|
+
"normative_detail": "条件付き必須（ping/push登録ならREQUIRED）",
|
|
781
|
+
"conditional": true,
|
|
782
|
+
"feature": "ping",
|
|
783
|
+
"responsibility": "gem",
|
|
784
|
+
"status": "code_reviewed",
|
|
785
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
786
|
+
"code_symbols": [],
|
|
787
|
+
"grouped_test_files": [
|
|
788
|
+
"test/ciba_protocol_test.rb",
|
|
789
|
+
"test/ciba_security_test.rb",
|
|
790
|
+
"test/ciba_ping_test.rb"
|
|
791
|
+
],
|
|
792
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
793
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
794
|
+
},
|
|
795
|
+
{
|
|
796
|
+
"id": "CIBA-034",
|
|
797
|
+
"section": "7.1",
|
|
798
|
+
"requirement": "Validate client_notification_token max 1024 characters and bearer credential syntax.",
|
|
799
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
800
|
+
"normative_level": "MUST_NOT",
|
|
801
|
+
"normative_detail": "条件付き必須（ping/push時; MUST NOT exceed 1024 / bearer syntax）",
|
|
802
|
+
"conditional": true,
|
|
803
|
+
"feature": "ping",
|
|
804
|
+
"responsibility": "gem",
|
|
805
|
+
"status": "code_reviewed",
|
|
806
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
807
|
+
"code_symbols": [],
|
|
808
|
+
"grouped_test_files": [
|
|
809
|
+
"test/ciba_protocol_test.rb",
|
|
810
|
+
"test/ciba_security_test.rb",
|
|
811
|
+
"test/ciba_ping_test.rb"
|
|
812
|
+
],
|
|
813
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
814
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
815
|
+
},
|
|
816
|
+
{
|
|
817
|
+
"id": "CIBA-035",
|
|
818
|
+
"section": "7.1",
|
|
819
|
+
"requirement": "Client ensures at least 128 bits entropy for client_notification_token, with 160 recommended.",
|
|
820
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
821
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
822
|
+
"normative_detail": "必須（client MUST ensure entropy; 160 bits is recommended）",
|
|
823
|
+
"conditional": true,
|
|
824
|
+
"feature": "core",
|
|
825
|
+
"responsibility": "client",
|
|
826
|
+
"status": "client_duty",
|
|
827
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
828
|
+
"code_symbols": [],
|
|
829
|
+
"grouped_test_files": [
|
|
830
|
+
"test/ciba_protocol_test.rb",
|
|
831
|
+
"test/ciba_security_test.rb",
|
|
832
|
+
"test/ciba_ping_test.rb"
|
|
833
|
+
],
|
|
834
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
835
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
836
|
+
},
|
|
837
|
+
{
|
|
838
|
+
"id": "CIBA-036",
|
|
839
|
+
"section": "7.1",
|
|
840
|
+
"requirement": "Accept requested space-separated acr_values and preserve preference order for authentication selection.",
|
|
841
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
842
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
843
|
+
"normative_detail": "任意（OPTIONAL acr_values; order is preference; OP discretion）",
|
|
844
|
+
"conditional": false,
|
|
845
|
+
"feature": "core",
|
|
846
|
+
"responsibility": "gem + app",
|
|
847
|
+
"status": "application_contract",
|
|
848
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
849
|
+
"code_symbols": [
|
|
850
|
+
"validate_ciba_transport!",
|
|
851
|
+
"validate_ciba_request!",
|
|
852
|
+
"resolve_ciba_login_hint",
|
|
853
|
+
"ciba_error"
|
|
854
|
+
],
|
|
855
|
+
"grouped_test_files": [
|
|
856
|
+
"test/ciba_protocol_test.rb",
|
|
857
|
+
"test/ciba_security_test.rb",
|
|
858
|
+
"test/ciba_ping_test.rb"
|
|
859
|
+
],
|
|
860
|
+
"historical_status_not_current_evidence": "verified",
|
|
861
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
862
|
+
},
|
|
863
|
+
{
|
|
864
|
+
"id": "CIBA-037",
|
|
865
|
+
"section": "7.1",
|
|
866
|
+
"requirement": "Report the authentication context actually achieved as acr in the ID Token; acr is highly recommended when acr_values was requested.",
|
|
867
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
868
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
869
|
+
"normative_detail": "強く推奨（highly RECOMMENDED acr claim when requested）",
|
|
870
|
+
"conditional": true,
|
|
871
|
+
"feature": "core",
|
|
872
|
+
"responsibility": "gem + upstream + app",
|
|
873
|
+
"status": "application_contract",
|
|
874
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
875
|
+
"code_symbols": [
|
|
876
|
+
"validate_ciba_transport!",
|
|
877
|
+
"validate_ciba_request!",
|
|
878
|
+
"resolve_ciba_login_hint",
|
|
879
|
+
"ciba_error"
|
|
880
|
+
],
|
|
881
|
+
"grouped_test_files": [
|
|
882
|
+
"test/ciba_protocol_test.rb",
|
|
883
|
+
"test/ciba_security_test.rb",
|
|
884
|
+
"test/ciba_ping_test.rb"
|
|
885
|
+
],
|
|
886
|
+
"historical_status_not_current_evidence": "verified",
|
|
887
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
888
|
+
},
|
|
889
|
+
{
|
|
890
|
+
"id": "CIBA-038",
|
|
891
|
+
"section": "7.1",
|
|
892
|
+
"requirement": "Support user identification via login_hint_token according to deployment-specific token format and validation policy.",
|
|
893
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
894
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
895
|
+
"normative_detail": "Optional parameter (OPTIONAL)",
|
|
896
|
+
"conditional": true,
|
|
897
|
+
"feature": "login_hint_token",
|
|
898
|
+
"responsibility": "gem",
|
|
899
|
+
"status": "code_reviewed",
|
|
900
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
901
|
+
"code_symbols": [],
|
|
902
|
+
"grouped_test_files": [
|
|
903
|
+
"test/ciba_protocol_test.rb",
|
|
904
|
+
"test/ciba_security_test.rb",
|
|
905
|
+
"test/ciba_ping_test.rb"
|
|
906
|
+
],
|
|
907
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
908
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "CIBA-039",
|
|
912
|
+
"section": "7.1",
|
|
913
|
+
"requirement": "Support user identification using an ID Token previously issued by the OP.",
|
|
914
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
915
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
916
|
+
"normative_detail": "Optional parameter (OPTIONAL)",
|
|
917
|
+
"conditional": true,
|
|
918
|
+
"feature": "id_token_hint",
|
|
919
|
+
"responsibility": "gem",
|
|
920
|
+
"status": "code_reviewed",
|
|
921
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
922
|
+
"code_symbols": [],
|
|
923
|
+
"grouped_test_files": [
|
|
924
|
+
"test/ciba_protocol_test.rb",
|
|
925
|
+
"test/ciba_security_test.rb",
|
|
926
|
+
"test/ciba_ping_test.rb"
|
|
927
|
+
],
|
|
928
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
929
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
930
|
+
},
|
|
931
|
+
{
|
|
932
|
+
"id": "CIBA-040",
|
|
933
|
+
"section": "7.1",
|
|
934
|
+
"requirement": "Client decrypts an asymmetrically encrypted ID Token before supplying it as id_token_hint.",
|
|
935
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
936
|
+
"normative_level": "MUST",
|
|
937
|
+
"normative_detail": "条件付き必須（暗号化ID Tokenをhintに使うclientはMUST decrypt）",
|
|
938
|
+
"conditional": true,
|
|
939
|
+
"feature": "core",
|
|
940
|
+
"responsibility": "client",
|
|
941
|
+
"status": "client_duty",
|
|
942
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
943
|
+
"code_symbols": [],
|
|
944
|
+
"grouped_test_files": [
|
|
945
|
+
"test/ciba_protocol_test.rb",
|
|
946
|
+
"test/ciba_security_test.rb",
|
|
947
|
+
"test/ciba_ping_test.rb"
|
|
948
|
+
],
|
|
949
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
950
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
951
|
+
},
|
|
952
|
+
{
|
|
953
|
+
"id": "CIBA-041",
|
|
954
|
+
"section": "7.1",
|
|
955
|
+
"requirement": "Support a login_hint string as a user identifier without requiring it to be an email address.",
|
|
956
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
957
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
958
|
+
"normative_detail": "任意（OPTIONAL login_hint）",
|
|
959
|
+
"conditional": false,
|
|
960
|
+
"feature": "core",
|
|
961
|
+
"responsibility": "gem + app",
|
|
962
|
+
"status": "application_contract",
|
|
963
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
964
|
+
"code_symbols": [
|
|
965
|
+
"validate_ciba_transport!",
|
|
966
|
+
"validate_ciba_request!",
|
|
967
|
+
"resolve_ciba_login_hint",
|
|
968
|
+
"ciba_error"
|
|
969
|
+
],
|
|
970
|
+
"grouped_test_files": [
|
|
971
|
+
"test/ciba_protocol_test.rb",
|
|
972
|
+
"test/ciba_security_test.rb",
|
|
973
|
+
"test/ciba_ping_test.rb"
|
|
974
|
+
],
|
|
975
|
+
"historical_status_not_current_evidence": "verified",
|
|
976
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
977
|
+
},
|
|
978
|
+
{
|
|
979
|
+
"id": "CIBA-042",
|
|
980
|
+
"section": "7.1",
|
|
981
|
+
"requirement": "Accept binding_message and make it available for display on both consumption and authentication devices.",
|
|
982
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
983
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
984
|
+
"normative_detail": "Optional parameter (OPTIONAL)",
|
|
985
|
+
"conditional": false,
|
|
986
|
+
"feature": "core",
|
|
987
|
+
"responsibility": "gem + app",
|
|
988
|
+
"status": "application_contract",
|
|
989
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
990
|
+
"code_symbols": [
|
|
991
|
+
"validate_ciba_transport!",
|
|
992
|
+
"validate_ciba_request!",
|
|
993
|
+
"resolve_ciba_login_hint",
|
|
994
|
+
"ciba_error"
|
|
995
|
+
],
|
|
996
|
+
"grouped_test_files": [
|
|
997
|
+
"test/ciba_protocol_test.rb",
|
|
998
|
+
"test/ciba_security_test.rb",
|
|
999
|
+
"test/ciba_ping_test.rb"
|
|
1000
|
+
],
|
|
1001
|
+
"historical_status_not_current_evidence": "verified",
|
|
1002
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1003
|
+
},
|
|
1004
|
+
{
|
|
1005
|
+
"id": "CIBA-043",
|
|
1006
|
+
"section": "7.1",
|
|
1007
|
+
"requirement": "Client chooses binding_message that lets the end-user correlate the initiating action and authentication device interaction.",
|
|
1008
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1009
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
1010
|
+
"normative_detail": "Recommendation (SHOULD)",
|
|
1011
|
+
"conditional": false,
|
|
1012
|
+
"feature": "core",
|
|
1013
|
+
"responsibility": "client",
|
|
1014
|
+
"status": "client_duty",
|
|
1015
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1016
|
+
"code_symbols": [],
|
|
1017
|
+
"grouped_test_files": [
|
|
1018
|
+
"test/ciba_protocol_test.rb",
|
|
1019
|
+
"test/ciba_security_test.rb",
|
|
1020
|
+
"test/ciba_ping_test.rb"
|
|
1021
|
+
],
|
|
1022
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1023
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1024
|
+
},
|
|
1025
|
+
{
|
|
1026
|
+
"id": "CIBA-044",
|
|
1027
|
+
"section": "7.1",
|
|
1028
|
+
"requirement": "Keep binding_message relatively short with a limited set of plain-text characters suitable for display.",
|
|
1029
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1030
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
1031
|
+
"normative_detail": "Recommendation (SHOULD)",
|
|
1032
|
+
"conditional": false,
|
|
1033
|
+
"feature": "core",
|
|
1034
|
+
"responsibility": "gem + app",
|
|
1035
|
+
"status": "application_contract",
|
|
1036
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1037
|
+
"code_symbols": [
|
|
1038
|
+
"validate_ciba_transport!",
|
|
1039
|
+
"validate_ciba_request!",
|
|
1040
|
+
"resolve_ciba_login_hint",
|
|
1041
|
+
"ciba_error"
|
|
1042
|
+
],
|
|
1043
|
+
"grouped_test_files": [
|
|
1044
|
+
"test/ciba_protocol_test.rb",
|
|
1045
|
+
"test/ciba_security_test.rb",
|
|
1046
|
+
"test/ciba_ping_test.rb"
|
|
1047
|
+
],
|
|
1048
|
+
"historical_status_not_current_evidence": "verified",
|
|
1049
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1050
|
+
},
|
|
1051
|
+
{
|
|
1052
|
+
"id": "CIBA-045",
|
|
1053
|
+
"section": "7.1",
|
|
1054
|
+
"requirement": "Support optional user_code validation when the OP/client has enabled it.",
|
|
1055
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1056
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
1057
|
+
"normative_detail": "任意（OPTIONAL user_code; lowercase “should only” condition is non-RFC2119）",
|
|
1058
|
+
"conditional": true,
|
|
1059
|
+
"feature": "user_code",
|
|
1060
|
+
"responsibility": "gem",
|
|
1061
|
+
"status": "code_reviewed",
|
|
1062
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1063
|
+
"code_symbols": [],
|
|
1064
|
+
"grouped_test_files": [
|
|
1065
|
+
"test/ciba_protocol_test.rb",
|
|
1066
|
+
"test/ciba_security_test.rb",
|
|
1067
|
+
"test/ciba_ping_test.rb"
|
|
1068
|
+
],
|
|
1069
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1070
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1071
|
+
},
|
|
1072
|
+
{
|
|
1073
|
+
"id": "CIBA-046",
|
|
1074
|
+
"section": "7.1",
|
|
1075
|
+
"requirement": "Accept optional requested_expiry as a positive integer.",
|
|
1076
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1077
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
1078
|
+
"normative_detail": "任意（OPTIONAL requested_expiry with positive-integer value）",
|
|
1079
|
+
"conditional": false,
|
|
1080
|
+
"feature": "core",
|
|
1081
|
+
"responsibility": "gem",
|
|
1082
|
+
"status": "code_reviewed",
|
|
1083
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1084
|
+
"code_symbols": [
|
|
1085
|
+
"validate_ciba_transport!",
|
|
1086
|
+
"validate_ciba_request!",
|
|
1087
|
+
"resolve_ciba_login_hint",
|
|
1088
|
+
"ciba_error"
|
|
1089
|
+
],
|
|
1090
|
+
"grouped_test_files": [
|
|
1091
|
+
"test/ciba_protocol_test.rb",
|
|
1092
|
+
"test/ciba_security_test.rb",
|
|
1093
|
+
"test/ciba_ping_test.rb"
|
|
1094
|
+
],
|
|
1095
|
+
"historical_status_not_current_evidence": "verified",
|
|
1096
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1097
|
+
},
|
|
1098
|
+
{
|
|
1099
|
+
"id": "CIBA-047",
|
|
1100
|
+
"section": "7.1",
|
|
1101
|
+
"requirement": "OP may use requested_expiry to influence the request lifetime; evaluate the implementation of this optional capability, not a mandatory obligation to honor it exactly.",
|
|
1102
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1103
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
1104
|
+
"normative_detail": "任意（server MAY honor; encouraged where useful）",
|
|
1105
|
+
"conditional": false,
|
|
1106
|
+
"feature": "core",
|
|
1107
|
+
"responsibility": "gem",
|
|
1108
|
+
"status": "code_reviewed",
|
|
1109
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1110
|
+
"code_symbols": [
|
|
1111
|
+
"validate_ciba_transport!",
|
|
1112
|
+
"validate_ciba_request!",
|
|
1113
|
+
"resolve_ciba_login_hint",
|
|
1114
|
+
"ciba_error"
|
|
1115
|
+
],
|
|
1116
|
+
"grouped_test_files": [
|
|
1117
|
+
"test/ciba_protocol_test.rb",
|
|
1118
|
+
"test/ciba_security_test.rb",
|
|
1119
|
+
"test/ciba_ping_test.rb"
|
|
1120
|
+
],
|
|
1121
|
+
"historical_status_not_current_evidence": "verified",
|
|
1122
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1123
|
+
},
|
|
1124
|
+
{
|
|
1125
|
+
"id": "CIBA-048",
|
|
1126
|
+
"section": "7.1",
|
|
1127
|
+
"requirement": "Require exactly one of login_hint, login_hint_token, id_token_hint in an authentication request.",
|
|
1128
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1",
|
|
1129
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1130
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1131
|
+
"conditional": false,
|
|
1132
|
+
"feature": "core",
|
|
1133
|
+
"responsibility": "gem",
|
|
1134
|
+
"status": "code_reviewed",
|
|
1135
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1136
|
+
"code_symbols": [
|
|
1137
|
+
"validate_ciba_transport!",
|
|
1138
|
+
"validate_ciba_request!",
|
|
1139
|
+
"resolve_ciba_login_hint",
|
|
1140
|
+
"ciba_error"
|
|
1141
|
+
],
|
|
1142
|
+
"grouped_test_files": [
|
|
1143
|
+
"test/ciba_protocol_test.rb",
|
|
1144
|
+
"test/ciba_security_test.rb",
|
|
1145
|
+
"test/ciba_ping_test.rb"
|
|
1146
|
+
],
|
|
1147
|
+
"historical_status_not_current_evidence": "verified",
|
|
1148
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1149
|
+
},
|
|
1150
|
+
{
|
|
1151
|
+
"id": "CIBA-049",
|
|
1152
|
+
"section": "7.1.1",
|
|
1153
|
+
"requirement": "Support signed authentication requests carried in the request parameter as a signed JWT containing all authentication parameters.",
|
|
1154
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1155
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1156
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1157
|
+
"conditional": true,
|
|
1158
|
+
"feature": "signed_requests",
|
|
1159
|
+
"responsibility": "gem",
|
|
1160
|
+
"status": "code_reviewed",
|
|
1161
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1162
|
+
"code_symbols": [],
|
|
1163
|
+
"grouped_test_files": [
|
|
1164
|
+
"test/ciba_signed_request_test.rb"
|
|
1165
|
+
],
|
|
1166
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1167
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1168
|
+
},
|
|
1169
|
+
{
|
|
1170
|
+
"id": "CIBA-050",
|
|
1171
|
+
"section": "7.1.1",
|
|
1172
|
+
"requirement": "Validate asymmetric signature for signed authentication requests.",
|
|
1173
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1174
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1175
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1176
|
+
"conditional": true,
|
|
1177
|
+
"feature": "signed_requests",
|
|
1178
|
+
"responsibility": "gem",
|
|
1179
|
+
"status": "code_reviewed",
|
|
1180
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1181
|
+
"code_symbols": [],
|
|
1182
|
+
"grouped_test_files": [
|
|
1183
|
+
"test/ciba_signed_request_test.rb"
|
|
1184
|
+
],
|
|
1185
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1186
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1187
|
+
},
|
|
1188
|
+
{
|
|
1189
|
+
"id": "CIBA-051",
|
|
1190
|
+
"section": "7.1.1",
|
|
1191
|
+
"requirement": "Validate signed request aud as the OP issuer.",
|
|
1192
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1193
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1194
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1195
|
+
"conditional": true,
|
|
1196
|
+
"feature": "signed_requests",
|
|
1197
|
+
"responsibility": "gem",
|
|
1198
|
+
"status": "code_reviewed",
|
|
1199
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1200
|
+
"code_symbols": [],
|
|
1201
|
+
"grouped_test_files": [
|
|
1202
|
+
"test/ciba_signed_request_test.rb"
|
|
1203
|
+
],
|
|
1204
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1205
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1206
|
+
},
|
|
1207
|
+
{
|
|
1208
|
+
"id": "CIBA-052",
|
|
1209
|
+
"section": "7.1.1",
|
|
1210
|
+
"requirement": "Validate signed request iss as the client_id.",
|
|
1211
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1212
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1213
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1214
|
+
"conditional": true,
|
|
1215
|
+
"feature": "signed_requests",
|
|
1216
|
+
"responsibility": "gem",
|
|
1217
|
+
"status": "code_reviewed",
|
|
1218
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1219
|
+
"code_symbols": [],
|
|
1220
|
+
"grouped_test_files": [
|
|
1221
|
+
"test/ciba_signed_request_test.rb"
|
|
1222
|
+
],
|
|
1223
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1224
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1225
|
+
},
|
|
1226
|
+
{
|
|
1227
|
+
"id": "CIBA-053",
|
|
1228
|
+
"section": "7.1.1",
|
|
1229
|
+
"requirement": "Require and validate exp on signed authentication requests.",
|
|
1230
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1231
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1232
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1233
|
+
"conditional": true,
|
|
1234
|
+
"feature": "signed_requests",
|
|
1235
|
+
"responsibility": "gem",
|
|
1236
|
+
"status": "code_reviewed",
|
|
1237
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1238
|
+
"code_symbols": [],
|
|
1239
|
+
"grouped_test_files": [
|
|
1240
|
+
"test/ciba_signed_request_test.rb"
|
|
1241
|
+
],
|
|
1242
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1243
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1244
|
+
},
|
|
1245
|
+
{
|
|
1246
|
+
"id": "CIBA-054",
|
|
1247
|
+
"section": "7.1.1",
|
|
1248
|
+
"requirement": "Require and validate iat on signed authentication requests.",
|
|
1249
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1250
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1251
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1252
|
+
"conditional": true,
|
|
1253
|
+
"feature": "signed_requests",
|
|
1254
|
+
"responsibility": "gem",
|
|
1255
|
+
"status": "code_reviewed",
|
|
1256
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1257
|
+
"code_symbols": [],
|
|
1258
|
+
"grouped_test_files": [
|
|
1259
|
+
"test/ciba_signed_request_test.rb"
|
|
1260
|
+
],
|
|
1261
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1262
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1263
|
+
},
|
|
1264
|
+
{
|
|
1265
|
+
"id": "CIBA-055",
|
|
1266
|
+
"section": "7.1.1",
|
|
1267
|
+
"requirement": "Require and validate nbf on signed authentication requests.",
|
|
1268
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1269
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1270
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1271
|
+
"conditional": true,
|
|
1272
|
+
"feature": "signed_requests",
|
|
1273
|
+
"responsibility": "gem",
|
|
1274
|
+
"status": "code_reviewed",
|
|
1275
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1276
|
+
"code_symbols": [],
|
|
1277
|
+
"grouped_test_files": [
|
|
1278
|
+
"test/ciba_signed_request_test.rb"
|
|
1279
|
+
],
|
|
1280
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1281
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1282
|
+
},
|
|
1283
|
+
{
|
|
1284
|
+
"id": "CIBA-056",
|
|
1285
|
+
"section": "7.1.1",
|
|
1286
|
+
"requirement": "Require a unique jti on signed authentication requests.",
|
|
1287
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1288
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1289
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1290
|
+
"conditional": true,
|
|
1291
|
+
"feature": "signed_requests",
|
|
1292
|
+
"responsibility": "gem",
|
|
1293
|
+
"status": "code_reviewed",
|
|
1294
|
+
"acceptance_gate": "Signed JWT includes a string jti. Client/issuer supplies uniqueness per RFC7519; request-jti consumption/replay prevention is not implemented. Empty jti is accepted. No blanket JWT conformance pass.",
|
|
1295
|
+
"code_symbols": [],
|
|
1296
|
+
"grouped_test_files": [
|
|
1297
|
+
"test/ciba_signed_request_test.rb"
|
|
1298
|
+
],
|
|
1299
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1300
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1301
|
+
},
|
|
1302
|
+
{
|
|
1303
|
+
"id": "CIBA-057",
|
|
1304
|
+
"section": "7.1.1",
|
|
1305
|
+
"requirement": "Accept requested_expiry as either JSON string or number inside signed authentication requests.",
|
|
1306
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1307
|
+
"normative_level": "definition_or_guidance",
|
|
1308
|
+
"normative_detail": "記述的要件（OP must accept either type; source uses lowercase “must”）",
|
|
1309
|
+
"conditional": true,
|
|
1310
|
+
"feature": "signed_requests",
|
|
1311
|
+
"responsibility": "gem",
|
|
1312
|
+
"status": "local_regression_verified",
|
|
1313
|
+
"acceptance_gate": "Signed requested_expiry accepts positive finite integral JSON numbers; targeted acceptance/rejection regression.",
|
|
1314
|
+
"code_symbols": [],
|
|
1315
|
+
"grouped_test_files": [
|
|
1316
|
+
"test/ciba_claim_constraints_test.rb"
|
|
1317
|
+
],
|
|
1318
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1319
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1320
|
+
},
|
|
1321
|
+
{
|
|
1322
|
+
"id": "CIBA-058",
|
|
1323
|
+
"section": "7.1.1",
|
|
1324
|
+
"requirement": "Do not allow authentication request parameters outside a signed request JWT; separate client authentication parameters remain outside.",
|
|
1325
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1326
|
+
"normative_level": "MUST_NOT",
|
|
1327
|
+
"normative_detail": "条件付き必須（署名付き認証要求を実装する場合）",
|
|
1328
|
+
"conditional": true,
|
|
1329
|
+
"feature": "signed_requests",
|
|
1330
|
+
"responsibility": "client + gem",
|
|
1331
|
+
"status": "code_reviewed",
|
|
1332
|
+
"acceptance_gate": "Client MUST omit unsigned authentication parameters; gem isolates signed parameters and never merges outer inputs. OP rejection of extra parameters is not independently mandated.",
|
|
1333
|
+
"code_symbols": [],
|
|
1334
|
+
"grouped_test_files": [
|
|
1335
|
+
"test/ciba_signed_request_test.rb"
|
|
1336
|
+
],
|
|
1337
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1338
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1339
|
+
},
|
|
1340
|
+
{
|
|
1341
|
+
"id": "CIBA-059",
|
|
1342
|
+
"section": "7.1.1",
|
|
1343
|
+
"requirement": "Do not treat encrypted JWT authentication requests as a supported signed-request format.",
|
|
1344
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.1",
|
|
1345
|
+
"normative_level": "definition_or_guidance",
|
|
1346
|
+
"normative_detail": "記述的要件（7.1.1 does not state the catalog prohibition as an RFC2119 rule）",
|
|
1347
|
+
"conditional": true,
|
|
1348
|
+
"feature": "signed_requests",
|
|
1349
|
+
"responsibility": "gem",
|
|
1350
|
+
"status": "code_reviewed",
|
|
1351
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1352
|
+
"code_symbols": [],
|
|
1353
|
+
"grouped_test_files": [
|
|
1354
|
+
"test/ciba_signed_request_test.rb"
|
|
1355
|
+
],
|
|
1356
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1357
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1358
|
+
},
|
|
1359
|
+
{
|
|
1360
|
+
"id": "CIBA-060",
|
|
1361
|
+
"section": "7.1.2",
|
|
1362
|
+
"requirement": "If user_code is supported, use a code distinct from the user's OP password.",
|
|
1363
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.2",
|
|
1364
|
+
"normative_level": "definition_or_guidance",
|
|
1365
|
+
"normative_detail": "仕様定義（user_codeの秘密値はOPのパスワードとは別）",
|
|
1366
|
+
"conditional": true,
|
|
1367
|
+
"feature": "user_code",
|
|
1368
|
+
"responsibility": "gem + app",
|
|
1369
|
+
"status": "application_contract",
|
|
1370
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1371
|
+
"code_symbols": [],
|
|
1372
|
+
"grouped_test_files": [
|
|
1373
|
+
"test/ciba_user_code_test.rb"
|
|
1374
|
+
],
|
|
1375
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1376
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1377
|
+
},
|
|
1378
|
+
{
|
|
1379
|
+
"id": "CIBA-061",
|
|
1380
|
+
"section": "7.1.2",
|
|
1381
|
+
"requirement": "If user_code is supported, allow policy for clients/users without it as permitted by the specification.",
|
|
1382
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.2",
|
|
1383
|
+
"normative_level": "definition_or_guidance",
|
|
1384
|
+
"normative_detail": "任意のポリシー（user_code対応時、例外を許容できる。lowercase may）",
|
|
1385
|
+
"conditional": true,
|
|
1386
|
+
"feature": "user_code",
|
|
1387
|
+
"responsibility": "gem + app",
|
|
1388
|
+
"status": "application_contract",
|
|
1389
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1390
|
+
"code_symbols": [],
|
|
1391
|
+
"grouped_test_files": [
|
|
1392
|
+
"test/ciba_user_code_test.rb"
|
|
1393
|
+
],
|
|
1394
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1395
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1396
|
+
},
|
|
1397
|
+
{
|
|
1398
|
+
"id": "CIBA-062",
|
|
1399
|
+
"section": "7.1.2",
|
|
1400
|
+
"requirement": "Client must not store user_code and requests it for each CIBA flow.",
|
|
1401
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.2",
|
|
1402
|
+
"normative_level": "MUST_NOT",
|
|
1403
|
+
"normative_detail": "必須（client MUST NOT store user_code）",
|
|
1404
|
+
"conditional": true,
|
|
1405
|
+
"feature": "core",
|
|
1406
|
+
"responsibility": "client",
|
|
1407
|
+
"status": "client_duty",
|
|
1408
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1409
|
+
"code_symbols": [],
|
|
1410
|
+
"grouped_test_files": [
|
|
1411
|
+
"test/ciba_user_code_test.rb"
|
|
1412
|
+
],
|
|
1413
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1414
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1415
|
+
},
|
|
1416
|
+
{
|
|
1417
|
+
"id": "CIBA-063",
|
|
1418
|
+
"section": "7.1.2",
|
|
1419
|
+
"requirement": "If user_code is supported, OP should provide a way for users to change it.",
|
|
1420
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.1.2",
|
|
1421
|
+
"normative_level": "definition_or_guidance",
|
|
1422
|
+
"normative_detail": "設計指針（user_code変更手段、lowercase should）",
|
|
1423
|
+
"conditional": true,
|
|
1424
|
+
"feature": "core",
|
|
1425
|
+
"responsibility": "app",
|
|
1426
|
+
"status": "application_contract",
|
|
1427
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1428
|
+
"code_symbols": [],
|
|
1429
|
+
"grouped_test_files": [
|
|
1430
|
+
"test/ciba_user_code_test.rb"
|
|
1431
|
+
],
|
|
1432
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1433
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1434
|
+
},
|
|
1435
|
+
{
|
|
1436
|
+
"id": "CIBA-064",
|
|
1437
|
+
"section": "7.2",
|
|
1438
|
+
"requirement": "Validate client authentication using the registered/configured method before accepting an authentication request.",
|
|
1439
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1440
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1441
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1442
|
+
"conditional": false,
|
|
1443
|
+
"feature": "core",
|
|
1444
|
+
"responsibility": "gem + upstream",
|
|
1445
|
+
"status": "code_reviewed",
|
|
1446
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1447
|
+
"code_symbols": [
|
|
1448
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
1449
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
1450
|
+
"require_oauth_application (upstream)"
|
|
1451
|
+
],
|
|
1452
|
+
"grouped_test_files": [
|
|
1453
|
+
"test/ciba_protocol_test.rb",
|
|
1454
|
+
"test/ciba_security_test.rb",
|
|
1455
|
+
"test/ciba_hint_token_test.rb"
|
|
1456
|
+
],
|
|
1457
|
+
"historical_status_not_current_evidence": "verified",
|
|
1458
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1459
|
+
},
|
|
1460
|
+
{
|
|
1461
|
+
"id": "CIBA-065",
|
|
1462
|
+
"section": "7.2",
|
|
1463
|
+
"requirement": "Support the recommended public-key client authentication alternative to sending shared secrets in requests.",
|
|
1464
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1465
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
1466
|
+
"normative_detail": "推奨（RECOMMENDED、Clientによる公開鍵認証の利用）",
|
|
1467
|
+
"conditional": false,
|
|
1468
|
+
"feature": "core",
|
|
1469
|
+
"responsibility": "client",
|
|
1470
|
+
"status": "client_duty",
|
|
1471
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1472
|
+
"code_symbols": [],
|
|
1473
|
+
"grouped_test_files": [
|
|
1474
|
+
"test/ciba_protocol_test.rb",
|
|
1475
|
+
"test/ciba_security_test.rb",
|
|
1476
|
+
"test/ciba_hint_token_test.rb"
|
|
1477
|
+
],
|
|
1478
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1479
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1480
|
+
},
|
|
1481
|
+
{
|
|
1482
|
+
"id": "CIBA-066",
|
|
1483
|
+
"section": "7.2",
|
|
1484
|
+
"requirement": "If signed requests are supported, validate JWT signature and all other applicable JWT validity constraints.",
|
|
1485
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1486
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1487
|
+
"normative_detail": "条件付き必須（署名付き要求がある場合。§7.2のMUST validateに含まれる）",
|
|
1488
|
+
"conditional": true,
|
|
1489
|
+
"feature": "signed_requests",
|
|
1490
|
+
"responsibility": "gem",
|
|
1491
|
+
"status": "code_reviewed",
|
|
1492
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1493
|
+
"code_symbols": [],
|
|
1494
|
+
"grouped_test_files": [
|
|
1495
|
+
"test/ciba_protocol_test.rb",
|
|
1496
|
+
"test/ciba_security_test.rb",
|
|
1497
|
+
"test/ciba_hint_token_test.rb"
|
|
1498
|
+
],
|
|
1499
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
1500
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1501
|
+
},
|
|
1502
|
+
{
|
|
1503
|
+
"id": "CIBA-067",
|
|
1504
|
+
"section": "7.2",
|
|
1505
|
+
"requirement": "Validate all authentication request parameters within the supported feature scope.",
|
|
1506
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1507
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1508
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1509
|
+
"conditional": false,
|
|
1510
|
+
"feature": "core",
|
|
1511
|
+
"responsibility": "gem",
|
|
1512
|
+
"status": "code_reviewed",
|
|
1513
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1514
|
+
"code_symbols": [
|
|
1515
|
+
"backchannel_authentication route",
|
|
1516
|
+
"ciba_request_accepted"
|
|
1517
|
+
],
|
|
1518
|
+
"grouped_test_files": [
|
|
1519
|
+
"test/ciba_protocol_test.rb",
|
|
1520
|
+
"test/ciba_security_test.rb",
|
|
1521
|
+
"test/ciba_hint_token_test.rb"
|
|
1522
|
+
],
|
|
1523
|
+
"historical_status_not_current_evidence": "verified",
|
|
1524
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1525
|
+
},
|
|
1526
|
+
{
|
|
1527
|
+
"id": "CIBA-068",
|
|
1528
|
+
"section": "7.2",
|
|
1529
|
+
"requirement": "Return invalid_request when multiple hints are provided.",
|
|
1530
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1531
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1532
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1533
|
+
"conditional": true,
|
|
1534
|
+
"feature": "core",
|
|
1535
|
+
"responsibility": "gem",
|
|
1536
|
+
"status": "code_reviewed",
|
|
1537
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1538
|
+
"code_symbols": [
|
|
1539
|
+
"backchannel_authentication route",
|
|
1540
|
+
"ciba_request_accepted"
|
|
1541
|
+
],
|
|
1542
|
+
"grouped_test_files": [
|
|
1543
|
+
"test/ciba_protocol_test.rb",
|
|
1544
|
+
"test/ciba_security_test.rb",
|
|
1545
|
+
"test/ciba_hint_token_test.rb"
|
|
1546
|
+
],
|
|
1547
|
+
"historical_status_not_current_evidence": "verified",
|
|
1548
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1549
|
+
},
|
|
1550
|
+
{
|
|
1551
|
+
"id": "CIBA-069",
|
|
1552
|
+
"section": "7.2",
|
|
1553
|
+
"requirement": "Process a supported hint to establish its validity and identify an eligible user before request acceptance.",
|
|
1554
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1555
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1556
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1557
|
+
"conditional": false,
|
|
1558
|
+
"feature": "core",
|
|
1559
|
+
"responsibility": "gem + app",
|
|
1560
|
+
"status": "application_contract",
|
|
1561
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1562
|
+
"code_symbols": [
|
|
1563
|
+
"validate_ciba_request!",
|
|
1564
|
+
"resolve_ciba_login_hint",
|
|
1565
|
+
"ciba_account_eligible?"
|
|
1566
|
+
],
|
|
1567
|
+
"grouped_test_files": [
|
|
1568
|
+
"test/ciba_protocol_test.rb",
|
|
1569
|
+
"test/ciba_security_test.rb",
|
|
1570
|
+
"test/ciba_hint_token_test.rb"
|
|
1571
|
+
],
|
|
1572
|
+
"historical_status_not_current_evidence": "verified",
|
|
1573
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1574
|
+
},
|
|
1575
|
+
{
|
|
1576
|
+
"id": "CIBA-070",
|
|
1577
|
+
"section": "7.2",
|
|
1578
|
+
"requirement": "Communicate accepted hint types and where applicable issuer/max-age policy to clients.",
|
|
1579
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1580
|
+
"normative_level": "definition_or_guidance",
|
|
1581
|
+
"normative_detail": "記述的要件（hint policy “should be communicated”; validation/information explicitly out of scope）",
|
|
1582
|
+
"conditional": false,
|
|
1583
|
+
"feature": "core",
|
|
1584
|
+
"responsibility": "gem + app",
|
|
1585
|
+
"status": "application_contract",
|
|
1586
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1587
|
+
"code_symbols": [
|
|
1588
|
+
"backchannel_authentication route",
|
|
1589
|
+
"ciba_request_accepted"
|
|
1590
|
+
],
|
|
1591
|
+
"grouped_test_files": [
|
|
1592
|
+
"test/ciba_protocol_test.rb",
|
|
1593
|
+
"test/ciba_security_test.rb",
|
|
1594
|
+
"test/ciba_hint_token_test.rb"
|
|
1595
|
+
],
|
|
1596
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
1597
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1598
|
+
},
|
|
1599
|
+
{
|
|
1600
|
+
"id": "CIBA-071",
|
|
1601
|
+
"section": "7.2",
|
|
1602
|
+
"requirement": "Return an appropriate Authentication Error Response for an invalid hint or unidentified user.",
|
|
1603
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1604
|
+
"normative_level": "definition_or_guidance",
|
|
1605
|
+
"normative_detail": "設計指針（lowercase should。応答コードの意味は§13参照）",
|
|
1606
|
+
"conditional": false,
|
|
1607
|
+
"feature": "core",
|
|
1608
|
+
"responsibility": "gem",
|
|
1609
|
+
"status": "code_reviewed",
|
|
1610
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1611
|
+
"code_symbols": [
|
|
1612
|
+
"backchannel_authentication route",
|
|
1613
|
+
"ciba_request_accepted"
|
|
1614
|
+
],
|
|
1615
|
+
"grouped_test_files": [
|
|
1616
|
+
"test/ciba_protocol_test.rb",
|
|
1617
|
+
"test/ciba_security_test.rb",
|
|
1618
|
+
"test/ciba_hint_token_test.rb"
|
|
1619
|
+
],
|
|
1620
|
+
"historical_status_not_current_evidence": "verified",
|
|
1621
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1622
|
+
},
|
|
1623
|
+
{
|
|
1624
|
+
"id": "CIBA-072",
|
|
1625
|
+
"section": "7.2",
|
|
1626
|
+
"requirement": "Verify required parameters are present and used according to their requirements.",
|
|
1627
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1628
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1629
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1630
|
+
"conditional": false,
|
|
1631
|
+
"feature": "core",
|
|
1632
|
+
"responsibility": "gem",
|
|
1633
|
+
"status": "code_reviewed",
|
|
1634
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1635
|
+
"code_symbols": [
|
|
1636
|
+
"backchannel_authentication route",
|
|
1637
|
+
"ciba_request_accepted"
|
|
1638
|
+
],
|
|
1639
|
+
"grouped_test_files": [
|
|
1640
|
+
"test/ciba_protocol_test.rb",
|
|
1641
|
+
"test/ciba_security_test.rb",
|
|
1642
|
+
"test/ciba_hint_token_test.rb"
|
|
1643
|
+
],
|
|
1644
|
+
"historical_status_not_current_evidence": "verified",
|
|
1645
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1646
|
+
},
|
|
1647
|
+
{
|
|
1648
|
+
"id": "CIBA-073",
|
|
1649
|
+
"section": "7.2",
|
|
1650
|
+
"requirement": "Ignore unrecognized authentication request parameters.",
|
|
1651
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1652
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1653
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1654
|
+
"conditional": false,
|
|
1655
|
+
"feature": "core",
|
|
1656
|
+
"responsibility": "gem",
|
|
1657
|
+
"status": "code_reviewed",
|
|
1658
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1659
|
+
"code_symbols": [
|
|
1660
|
+
"backchannel_authentication route",
|
|
1661
|
+
"ciba_request_accepted"
|
|
1662
|
+
],
|
|
1663
|
+
"grouped_test_files": [
|
|
1664
|
+
"test/ciba_protocol_test.rb",
|
|
1665
|
+
"test/ciba_security_test.rb",
|
|
1666
|
+
"test/ciba_hint_token_test.rb"
|
|
1667
|
+
],
|
|
1668
|
+
"historical_status_not_current_evidence": "verified",
|
|
1669
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1670
|
+
},
|
|
1671
|
+
{
|
|
1672
|
+
"id": "CIBA-074",
|
|
1673
|
+
"section": "7.2",
|
|
1674
|
+
"requirement": "Return Authentication Error Responses per section 13 when authentication request validation fails.",
|
|
1675
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.2",
|
|
1676
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1677
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1678
|
+
"conditional": true,
|
|
1679
|
+
"feature": "core",
|
|
1680
|
+
"responsibility": "gem",
|
|
1681
|
+
"status": "code_reviewed",
|
|
1682
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1683
|
+
"code_symbols": [
|
|
1684
|
+
"backchannel_authentication route",
|
|
1685
|
+
"ciba_request_accepted"
|
|
1686
|
+
],
|
|
1687
|
+
"grouped_test_files": [
|
|
1688
|
+
"test/ciba_protocol_test.rb",
|
|
1689
|
+
"test/ciba_security_test.rb",
|
|
1690
|
+
"test/ciba_hint_token_test.rb"
|
|
1691
|
+
],
|
|
1692
|
+
"historical_status_not_current_evidence": "verified",
|
|
1693
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1694
|
+
},
|
|
1695
|
+
{
|
|
1696
|
+
"id": "CIBA-075",
|
|
1697
|
+
"section": "7.3",
|
|
1698
|
+
"requirement": "Return HTTP 200 acknowledgement after validating and accepting an authentication request.",
|
|
1699
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1700
|
+
"normative_level": "definition_or_guidance",
|
|
1701
|
+
"normative_detail": "応答定義（成功時HTTP 200、MUSTという語ではない）",
|
|
1702
|
+
"conditional": false,
|
|
1703
|
+
"feature": "core",
|
|
1704
|
+
"responsibility": "gem",
|
|
1705
|
+
"status": "code_reviewed",
|
|
1706
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1707
|
+
"code_symbols": [
|
|
1708
|
+
"json_response_success (upstream)",
|
|
1709
|
+
"ciba_error"
|
|
1710
|
+
],
|
|
1711
|
+
"grouped_test_files": [
|
|
1712
|
+
"test/ciba_requirements_test.rb",
|
|
1713
|
+
"test/ciba_conformance_test.rb"
|
|
1714
|
+
],
|
|
1715
|
+
"historical_status_not_current_evidence": "verified",
|
|
1716
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1717
|
+
},
|
|
1718
|
+
{
|
|
1719
|
+
"id": "CIBA-076",
|
|
1720
|
+
"section": "7.3",
|
|
1721
|
+
"requirement": "Return a unique auth_req_id in the acknowledgement.",
|
|
1722
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1723
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1724
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1725
|
+
"conditional": false,
|
|
1726
|
+
"feature": "core",
|
|
1727
|
+
"responsibility": "gem",
|
|
1728
|
+
"status": "code_reviewed",
|
|
1729
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1730
|
+
"code_symbols": [
|
|
1731
|
+
"backchannel_authentication route",
|
|
1732
|
+
"validate_ciba_request!"
|
|
1733
|
+
],
|
|
1734
|
+
"grouped_test_files": [
|
|
1735
|
+
"test/ciba_requirements_test.rb",
|
|
1736
|
+
"test/ciba_conformance_test.rb"
|
|
1737
|
+
],
|
|
1738
|
+
"historical_status_not_current_evidence": "verified",
|
|
1739
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1740
|
+
},
|
|
1741
|
+
{
|
|
1742
|
+
"id": "CIBA-077",
|
|
1743
|
+
"section": "7.3",
|
|
1744
|
+
"requirement": "Generate auth_req_id with at least 128 bits entropy, preferably at least 160 bits.",
|
|
1745
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1746
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1747
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1748
|
+
"conditional": false,
|
|
1749
|
+
"feature": "core",
|
|
1750
|
+
"responsibility": "gem",
|
|
1751
|
+
"status": "code_reviewed",
|
|
1752
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1753
|
+
"code_symbols": [
|
|
1754
|
+
"SecureRandom.urlsafe_base64(32) in backchannel_authentication route"
|
|
1755
|
+
],
|
|
1756
|
+
"grouped_test_files": [
|
|
1757
|
+
"test/ciba_requirements_test.rb",
|
|
1758
|
+
"test/ciba_conformance_test.rb"
|
|
1759
|
+
],
|
|
1760
|
+
"historical_status_not_current_evidence": "code_review_only",
|
|
1761
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1762
|
+
},
|
|
1763
|
+
{
|
|
1764
|
+
"id": "CIBA-078",
|
|
1765
|
+
"section": "7.3",
|
|
1766
|
+
"requirement": "Restrict auth_req_id to A-Z a-z 0-9 dot hyphen underscore.",
|
|
1767
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1768
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1769
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1770
|
+
"conditional": false,
|
|
1771
|
+
"feature": "core",
|
|
1772
|
+
"responsibility": "gem",
|
|
1773
|
+
"status": "code_reviewed",
|
|
1774
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1775
|
+
"code_symbols": [
|
|
1776
|
+
"backchannel_authentication route",
|
|
1777
|
+
"validate_ciba_request!"
|
|
1778
|
+
],
|
|
1779
|
+
"grouped_test_files": [
|
|
1780
|
+
"test/ciba_requirements_test.rb",
|
|
1781
|
+
"test/ciba_conformance_test.rb"
|
|
1782
|
+
],
|
|
1783
|
+
"historical_status_not_current_evidence": "verified",
|
|
1784
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1785
|
+
},
|
|
1786
|
+
{
|
|
1787
|
+
"id": "CIBA-079",
|
|
1788
|
+
"section": "7.3",
|
|
1789
|
+
"requirement": "Client treats auth_req_id as opaque.",
|
|
1790
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1791
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1792
|
+
"normative_detail": "必須（Client MUST treat auth_req_id as opaque）",
|
|
1793
|
+
"conditional": false,
|
|
1794
|
+
"feature": "core",
|
|
1795
|
+
"responsibility": "client",
|
|
1796
|
+
"status": "client_duty",
|
|
1797
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1798
|
+
"code_symbols": [],
|
|
1799
|
+
"grouped_test_files": [
|
|
1800
|
+
"test/ciba_requirements_test.rb",
|
|
1801
|
+
"test/ciba_conformance_test.rb"
|
|
1802
|
+
],
|
|
1803
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1804
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1805
|
+
},
|
|
1806
|
+
{
|
|
1807
|
+
"id": "CIBA-080",
|
|
1808
|
+
"section": "7.3",
|
|
1809
|
+
"requirement": "Return expires_in as a positive integer JSON number measuring request lifetime in seconds from receipt.",
|
|
1810
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1811
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1812
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1813
|
+
"conditional": false,
|
|
1814
|
+
"feature": "core",
|
|
1815
|
+
"responsibility": "gem",
|
|
1816
|
+
"status": "local_regression_verified",
|
|
1817
|
+
"acceptance_gate": "Receive-time expiry regression in ciba_conformance_test.rb",
|
|
1818
|
+
"code_symbols": [
|
|
1819
|
+
"backchannel_authentication route",
|
|
1820
|
+
"validate_ciba_request!"
|
|
1821
|
+
],
|
|
1822
|
+
"grouped_test_files": [
|
|
1823
|
+
"test/ciba_requirements_test.rb",
|
|
1824
|
+
"test/ciba_conformance_test.rb"
|
|
1825
|
+
],
|
|
1826
|
+
"historical_status_not_current_evidence": "verified",
|
|
1827
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1828
|
+
},
|
|
1829
|
+
{
|
|
1830
|
+
"id": "CIBA-081",
|
|
1831
|
+
"section": "7.3",
|
|
1832
|
+
"requirement": "If provided for poll/ping, return interval as a positive integer JSON number in seconds.",
|
|
1833
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1834
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
1835
|
+
"normative_detail": "任意（interval is OPTIONAL; if supplied, positive integer; client MUST wait; default rule separate ID 82）",
|
|
1836
|
+
"conditional": true,
|
|
1837
|
+
"feature": "core",
|
|
1838
|
+
"responsibility": "gem",
|
|
1839
|
+
"status": "code_reviewed",
|
|
1840
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
1841
|
+
"code_symbols": [
|
|
1842
|
+
"backchannel_authentication route",
|
|
1843
|
+
"validate_ciba_request!"
|
|
1844
|
+
],
|
|
1845
|
+
"grouped_test_files": [
|
|
1846
|
+
"test/ciba_requirements_test.rb",
|
|
1847
|
+
"test/ciba_conformance_test.rb"
|
|
1848
|
+
],
|
|
1849
|
+
"historical_status_not_current_evidence": "verified",
|
|
1850
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1851
|
+
},
|
|
1852
|
+
{
|
|
1853
|
+
"id": "CIBA-082",
|
|
1854
|
+
"section": "7.3",
|
|
1855
|
+
"requirement": "Client uses five seconds when interval is omitted.",
|
|
1856
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1857
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1858
|
+
"normative_detail": "必須（client MUST use 5-second default when interval omitted）",
|
|
1859
|
+
"conditional": true,
|
|
1860
|
+
"feature": "core",
|
|
1861
|
+
"responsibility": "client",
|
|
1862
|
+
"status": "client_duty",
|
|
1863
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1864
|
+
"code_symbols": [],
|
|
1865
|
+
"grouped_test_files": [
|
|
1866
|
+
"test/ciba_requirements_test.rb",
|
|
1867
|
+
"test/ciba_conformance_test.rb"
|
|
1868
|
+
],
|
|
1869
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1870
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1871
|
+
},
|
|
1872
|
+
{
|
|
1873
|
+
"id": "CIBA-083",
|
|
1874
|
+
"section": "7.3",
|
|
1875
|
+
"requirement": "Client ignores unrecognized acknowledgement response parameters.",
|
|
1876
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.3",
|
|
1877
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1878
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1879
|
+
"conditional": false,
|
|
1880
|
+
"feature": "core",
|
|
1881
|
+
"responsibility": "client",
|
|
1882
|
+
"status": "client_duty",
|
|
1883
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1884
|
+
"code_symbols": [],
|
|
1885
|
+
"grouped_test_files": [
|
|
1886
|
+
"test/ciba_requirements_test.rb",
|
|
1887
|
+
"test/ciba_conformance_test.rb"
|
|
1888
|
+
],
|
|
1889
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1890
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1891
|
+
},
|
|
1892
|
+
{
|
|
1893
|
+
"id": "CIBA-084",
|
|
1894
|
+
"section": "7.4",
|
|
1895
|
+
"requirement": "Client validates required acknowledgement parameters on HTTP 200.",
|
|
1896
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.4",
|
|
1897
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1898
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1899
|
+
"conditional": false,
|
|
1900
|
+
"feature": "core",
|
|
1901
|
+
"responsibility": "client",
|
|
1902
|
+
"status": "client_duty",
|
|
1903
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1904
|
+
"code_symbols": [],
|
|
1905
|
+
"grouped_test_files": [],
|
|
1906
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1907
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1908
|
+
},
|
|
1909
|
+
{
|
|
1910
|
+
"id": "CIBA-085",
|
|
1911
|
+
"section": "7.4",
|
|
1912
|
+
"requirement": "Client retains auth_req_id for subsequent polling or callback validation.",
|
|
1913
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.4",
|
|
1914
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1915
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1916
|
+
"conditional": false,
|
|
1917
|
+
"feature": "core",
|
|
1918
|
+
"responsibility": "client",
|
|
1919
|
+
"status": "client_duty",
|
|
1920
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1921
|
+
"code_symbols": [],
|
|
1922
|
+
"grouped_test_files": [],
|
|
1923
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1924
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1925
|
+
},
|
|
1926
|
+
{
|
|
1927
|
+
"id": "CIBA-086",
|
|
1928
|
+
"section": "7.4",
|
|
1929
|
+
"requirement": "Client should retain expiry for cleanup of requests awaiting callback.",
|
|
1930
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.7.4",
|
|
1931
|
+
"normative_level": "definition_or_guidance",
|
|
1932
|
+
"normative_detail": "設計指針（期限保存、lowercase should）",
|
|
1933
|
+
"conditional": false,
|
|
1934
|
+
"feature": "core",
|
|
1935
|
+
"responsibility": "client",
|
|
1936
|
+
"status": "client_duty",
|
|
1937
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
1938
|
+
"code_symbols": [],
|
|
1939
|
+
"grouped_test_files": [],
|
|
1940
|
+
"historical_status_not_current_evidence": "client_only",
|
|
1941
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1942
|
+
},
|
|
1943
|
+
{
|
|
1944
|
+
"id": "CIBA-087",
|
|
1945
|
+
"section": "8",
|
|
1946
|
+
"requirement": "OP identifies user and chooses an authentication channel considering acr_values; evaluate gem/application responsibility separately.",
|
|
1947
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.8",
|
|
1948
|
+
"normative_level": "definition_or_guidance",
|
|
1949
|
+
"normative_detail": "記述的要件（§8 places user/channel/acr selection in OP process; catalog added an evaluation abstraction）",
|
|
1950
|
+
"conditional": false,
|
|
1951
|
+
"feature": "core",
|
|
1952
|
+
"responsibility": "gem + app",
|
|
1953
|
+
"status": "application_contract",
|
|
1954
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1955
|
+
"code_symbols": [
|
|
1956
|
+
"create_token",
|
|
1957
|
+
"id_token_claims"
|
|
1958
|
+
],
|
|
1959
|
+
"grouped_test_files": [
|
|
1960
|
+
"test/ciba_lifecycle_test.rb",
|
|
1961
|
+
"test/ciba_alignment_test.rb"
|
|
1962
|
+
],
|
|
1963
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
1964
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1965
|
+
},
|
|
1966
|
+
{
|
|
1967
|
+
"id": "CIBA-088",
|
|
1968
|
+
"section": "8",
|
|
1969
|
+
"requirement": "Before successful token issuance, obtain the authenticated end-user's authorization decision per OIDC Core 3.1.2.4.",
|
|
1970
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.8",
|
|
1971
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1972
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1973
|
+
"conditional": false,
|
|
1974
|
+
"feature": "core",
|
|
1975
|
+
"responsibility": "gem + app",
|
|
1976
|
+
"status": "application_contract",
|
|
1977
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
1978
|
+
"code_symbols": [
|
|
1979
|
+
"approve_ciba_request",
|
|
1980
|
+
"ciba_complete",
|
|
1981
|
+
"create_token"
|
|
1982
|
+
],
|
|
1983
|
+
"grouped_test_files": [
|
|
1984
|
+
"test/ciba_lifecycle_test.rb",
|
|
1985
|
+
"test/ciba_alignment_test.rb"
|
|
1986
|
+
],
|
|
1987
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
1988
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
1989
|
+
},
|
|
1990
|
+
{
|
|
1991
|
+
"id": "CIBA-089",
|
|
1992
|
+
"section": "10",
|
|
1993
|
+
"requirement": "Deliver authentication result only through the client's single registered delivery mode.",
|
|
1994
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10",
|
|
1995
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
1996
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
1997
|
+
"conditional": false,
|
|
1998
|
+
"feature": "core",
|
|
1999
|
+
"responsibility": "gem",
|
|
2000
|
+
"status": "code_reviewed",
|
|
2001
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2002
|
+
"code_symbols": [
|
|
2003
|
+
"create_token",
|
|
2004
|
+
"validate_token_params"
|
|
2005
|
+
],
|
|
2006
|
+
"grouped_test_files": [
|
|
2007
|
+
"test/ciba_integration_test.rb",
|
|
2008
|
+
"test/ciba_ping_test.rb"
|
|
2009
|
+
],
|
|
2010
|
+
"historical_status_not_current_evidence": "verified",
|
|
2011
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2012
|
+
},
|
|
2013
|
+
{
|
|
2014
|
+
"id": "CIBA-090",
|
|
2015
|
+
"section": "10.1",
|
|
2016
|
+
"requirement": "Require registered client authentication for CIBA token requests.",
|
|
2017
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2018
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2019
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2020
|
+
"conditional": false,
|
|
2021
|
+
"feature": "core",
|
|
2022
|
+
"responsibility": "gem + upstream",
|
|
2023
|
+
"status": "code_reviewed",
|
|
2024
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2025
|
+
"code_symbols": [
|
|
2026
|
+
"CibaSupport::ClientAuthentication#require_oauth_application",
|
|
2027
|
+
"CibaSupport::ClientAuthentication#jwt_assertion",
|
|
2028
|
+
"require_oauth_application (upstream)"
|
|
2029
|
+
],
|
|
2030
|
+
"grouped_test_files": [
|
|
2031
|
+
"test/ciba_security_test.rb",
|
|
2032
|
+
"test/ciba_integration_test.rb"
|
|
2033
|
+
],
|
|
2034
|
+
"historical_status_not_current_evidence": "verified",
|
|
2035
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2036
|
+
},
|
|
2037
|
+
{
|
|
2038
|
+
"id": "CIBA-091",
|
|
2039
|
+
"section": "10.1",
|
|
2040
|
+
"requirement": "Client must not poll more frequently than the OP's minimum interval.",
|
|
2041
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2042
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2043
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2044
|
+
"conditional": false,
|
|
2045
|
+
"feature": "core",
|
|
2046
|
+
"responsibility": "client",
|
|
2047
|
+
"status": "client_duty",
|
|
2048
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2049
|
+
"code_symbols": [],
|
|
2050
|
+
"grouped_test_files": [
|
|
2051
|
+
"test/ciba_security_test.rb",
|
|
2052
|
+
"test/ciba_integration_test.rb"
|
|
2053
|
+
],
|
|
2054
|
+
"historical_status_not_current_evidence": "client_only",
|
|
2055
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2056
|
+
},
|
|
2057
|
+
{
|
|
2058
|
+
"id": "CIBA-092",
|
|
2059
|
+
"section": "10.1",
|
|
2060
|
+
"requirement": "Optionally support long polling with a recommended timeout of 30 seconds.",
|
|
2061
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2062
|
+
"normative_level": "definition_or_guidance",
|
|
2063
|
+
"normative_detail": "任意（long polling、lowercase may。30秒は参照仕様の推奨）",
|
|
2064
|
+
"conditional": true,
|
|
2065
|
+
"feature": "core",
|
|
2066
|
+
"responsibility": "gem",
|
|
2067
|
+
"status": "optional_not_implemented",
|
|
2068
|
+
"acceptance_gate": "Long polling not offered",
|
|
2069
|
+
"code_symbols": [],
|
|
2070
|
+
"grouped_test_files": [
|
|
2071
|
+
"test/ciba_security_test.rb",
|
|
2072
|
+
"test/ciba_integration_test.rb"
|
|
2073
|
+
],
|
|
2074
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2075
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2076
|
+
},
|
|
2077
|
+
{
|
|
2078
|
+
"id": "CIBA-093",
|
|
2079
|
+
"section": "10.1",
|
|
2080
|
+
"requirement": "OP should not take more than 30 seconds to respond to polling requests.",
|
|
2081
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2082
|
+
"normative_level": "definition_or_guidance",
|
|
2083
|
+
"normative_detail": "推奨（OP should not take more than 30 seconds; source lowercase should）",
|
|
2084
|
+
"conditional": false,
|
|
2085
|
+
"feature": "core",
|
|
2086
|
+
"responsibility": "gem + deployment",
|
|
2087
|
+
"status": "application_contract",
|
|
2088
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
2089
|
+
"code_symbols": [
|
|
2090
|
+
"ciba_http"
|
|
2091
|
+
],
|
|
2092
|
+
"grouped_test_files": [
|
|
2093
|
+
"test/ciba_security_test.rb",
|
|
2094
|
+
"test/ciba_integration_test.rb"
|
|
2095
|
+
],
|
|
2096
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
2097
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2098
|
+
},
|
|
2099
|
+
{
|
|
2100
|
+
"id": "CIBA-094",
|
|
2101
|
+
"section": "10.1",
|
|
2102
|
+
"requirement": "Client must not send overlapping requests using the same auth_req_id.",
|
|
2103
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2104
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2105
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2106
|
+
"conditional": false,
|
|
2107
|
+
"feature": "core",
|
|
2108
|
+
"responsibility": "client",
|
|
2109
|
+
"status": "client_duty",
|
|
2110
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2111
|
+
"code_symbols": [],
|
|
2112
|
+
"grouped_test_files": [
|
|
2113
|
+
"test/ciba_security_test.rb",
|
|
2114
|
+
"test/ciba_integration_test.rb"
|
|
2115
|
+
],
|
|
2116
|
+
"historical_status_not_current_evidence": "client_only",
|
|
2117
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2118
|
+
},
|
|
2119
|
+
{
|
|
2120
|
+
"id": "CIBA-095",
|
|
2121
|
+
"section": "10.1",
|
|
2122
|
+
"requirement": "OP may return HTTP 503 with Retry-After under load; evaluate this optional behavior.",
|
|
2123
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2124
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
2125
|
+
"normative_detail": "任意（OP MAY return 503 / Retry-After under stated condition）",
|
|
2126
|
+
"conditional": false,
|
|
2127
|
+
"feature": "core",
|
|
2128
|
+
"responsibility": "gem",
|
|
2129
|
+
"status": "code_reviewed",
|
|
2130
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2131
|
+
"code_symbols": [
|
|
2132
|
+
"ciba_http"
|
|
2133
|
+
],
|
|
2134
|
+
"grouped_test_files": [
|
|
2135
|
+
"test/ciba_security_test.rb",
|
|
2136
|
+
"test/ciba_integration_test.rb"
|
|
2137
|
+
],
|
|
2138
|
+
"historical_status_not_current_evidence": "verified",
|
|
2139
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2140
|
+
},
|
|
2141
|
+
{
|
|
2142
|
+
"id": "CIBA-096",
|
|
2143
|
+
"section": "10.1",
|
|
2144
|
+
"requirement": "Client should respect Retry-After before retrying a token request.",
|
|
2145
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2146
|
+
"normative_level": "definition_or_guidance",
|
|
2147
|
+
"normative_detail": "推奨（client should respect Retry-After; lowercase should）",
|
|
2148
|
+
"conditional": false,
|
|
2149
|
+
"feature": "core",
|
|
2150
|
+
"responsibility": "client",
|
|
2151
|
+
"status": "client_duty",
|
|
2152
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2153
|
+
"code_symbols": [],
|
|
2154
|
+
"grouped_test_files": [
|
|
2155
|
+
"test/ciba_security_test.rb",
|
|
2156
|
+
"test/ciba_integration_test.rb"
|
|
2157
|
+
],
|
|
2158
|
+
"historical_status_not_current_evidence": "client_only",
|
|
2159
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2160
|
+
},
|
|
2161
|
+
{
|
|
2162
|
+
"id": "CIBA-097",
|
|
2163
|
+
"section": "10.1",
|
|
2164
|
+
"requirement": "Treat a ping client that polls the token endpoint as a poll client.",
|
|
2165
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2166
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2167
|
+
"normative_detail": "条件付き必須（§10.1、ping clientがpollした場合はMUST treat as poll）",
|
|
2168
|
+
"conditional": true,
|
|
2169
|
+
"feature": "ping",
|
|
2170
|
+
"responsibility": "gem",
|
|
2171
|
+
"status": "code_reviewed",
|
|
2172
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2173
|
+
"code_symbols": [],
|
|
2174
|
+
"grouped_test_files": [
|
|
2175
|
+
"test/ciba_security_test.rb",
|
|
2176
|
+
"test/ciba_integration_test.rb"
|
|
2177
|
+
],
|
|
2178
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2179
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2180
|
+
},
|
|
2181
|
+
{
|
|
2182
|
+
"id": "CIBA-098",
|
|
2183
|
+
"section": "10.1",
|
|
2184
|
+
"requirement": "Accept CIBA token requests as HTTP POST form-urlencoded UTF-8 bodies.",
|
|
2185
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2186
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2187
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2188
|
+
"conditional": false,
|
|
2189
|
+
"feature": "core",
|
|
2190
|
+
"responsibility": "gem + upstream",
|
|
2191
|
+
"status": "code_reviewed",
|
|
2192
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2193
|
+
"code_symbols": [
|
|
2194
|
+
"validate_token_params",
|
|
2195
|
+
"create_token"
|
|
2196
|
+
],
|
|
2197
|
+
"grouped_test_files": [
|
|
2198
|
+
"test/ciba_security_test.rb",
|
|
2199
|
+
"test/ciba_integration_test.rb"
|
|
2200
|
+
],
|
|
2201
|
+
"historical_status_not_current_evidence": "verified",
|
|
2202
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2203
|
+
},
|
|
2204
|
+
{
|
|
2205
|
+
"id": "CIBA-099",
|
|
2206
|
+
"section": "10.1",
|
|
2207
|
+
"requirement": "Require exact CIBA grant_type in token requests.",
|
|
2208
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2209
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2210
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2211
|
+
"conditional": false,
|
|
2212
|
+
"feature": "core",
|
|
2213
|
+
"responsibility": "gem + upstream",
|
|
2214
|
+
"status": "code_reviewed",
|
|
2215
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2216
|
+
"code_symbols": [
|
|
2217
|
+
"validate_token_params",
|
|
2218
|
+
"create_token"
|
|
2219
|
+
],
|
|
2220
|
+
"grouped_test_files": [
|
|
2221
|
+
"test/ciba_security_test.rb",
|
|
2222
|
+
"test/ciba_integration_test.rb"
|
|
2223
|
+
],
|
|
2224
|
+
"historical_status_not_current_evidence": "verified",
|
|
2225
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2226
|
+
},
|
|
2227
|
+
{
|
|
2228
|
+
"id": "CIBA-100",
|
|
2229
|
+
"section": "10.1",
|
|
2230
|
+
"requirement": "Require auth_req_id in token requests.",
|
|
2231
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2232
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2233
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2234
|
+
"conditional": false,
|
|
2235
|
+
"feature": "core",
|
|
2236
|
+
"responsibility": "gem",
|
|
2237
|
+
"status": "code_reviewed",
|
|
2238
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2239
|
+
"code_symbols": [
|
|
2240
|
+
"validate_token_params",
|
|
2241
|
+
"create_token"
|
|
2242
|
+
],
|
|
2243
|
+
"grouped_test_files": [
|
|
2244
|
+
"test/ciba_security_test.rb",
|
|
2245
|
+
"test/ciba_integration_test.rb"
|
|
2246
|
+
],
|
|
2247
|
+
"historical_status_not_current_evidence": "verified",
|
|
2248
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2249
|
+
},
|
|
2250
|
+
{
|
|
2251
|
+
"id": "CIBA-101",
|
|
2252
|
+
"section": "10.1",
|
|
2253
|
+
"requirement": "Verify auth_req_id was issued to the authenticated requesting client; reject mismatch.",
|
|
2254
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1",
|
|
2255
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2256
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2257
|
+
"conditional": false,
|
|
2258
|
+
"feature": "core",
|
|
2259
|
+
"responsibility": "gem",
|
|
2260
|
+
"status": "code_reviewed",
|
|
2261
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2262
|
+
"code_symbols": [
|
|
2263
|
+
"validate_token_params",
|
|
2264
|
+
"create_token"
|
|
2265
|
+
],
|
|
2266
|
+
"grouped_test_files": [
|
|
2267
|
+
"test/ciba_security_test.rb",
|
|
2268
|
+
"test/ciba_integration_test.rb"
|
|
2269
|
+
],
|
|
2270
|
+
"historical_status_not_current_evidence": "verified",
|
|
2271
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2272
|
+
},
|
|
2273
|
+
{
|
|
2274
|
+
"id": "CIBA-102",
|
|
2275
|
+
"section": "10.1.1",
|
|
2276
|
+
"requirement": "After customer authentication and authorization, return the successful token response specified by OIDC Core 3.1.3.3 (access_token, token_type, id_token and applicable lifetime fields).",
|
|
2277
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1.1",
|
|
2278
|
+
"normative_level": "definition_or_guidance",
|
|
2279
|
+
"normative_detail": "応答定義（成功応答はOIDC Core §3.1.3.3を参照）",
|
|
2280
|
+
"conditional": false,
|
|
2281
|
+
"feature": "core",
|
|
2282
|
+
"responsibility": "gem + upstream",
|
|
2283
|
+
"status": "code_reviewed",
|
|
2284
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2285
|
+
"code_symbols": [
|
|
2286
|
+
"create_token",
|
|
2287
|
+
"id_token_claims"
|
|
2288
|
+
],
|
|
2289
|
+
"grouped_test_files": [
|
|
2290
|
+
"test/ciba_integration_test.rb",
|
|
2291
|
+
"test/ciba_conformance_test.rb"
|
|
2292
|
+
],
|
|
2293
|
+
"historical_status_not_current_evidence": "verified",
|
|
2294
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2295
|
+
},
|
|
2296
|
+
{
|
|
2297
|
+
"id": "CIBA-103",
|
|
2298
|
+
"section": "10.1.1",
|
|
2299
|
+
"requirement": "Invalidate auth_req_id after a successful redemption, including concurrent requests.",
|
|
2300
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1.1",
|
|
2301
|
+
"normative_level": "definition_or_guidance",
|
|
2302
|
+
"normative_detail": "応答定義（成功引換え後はauth_req_idが無効。MUSTという語ではない）",
|
|
2303
|
+
"conditional": false,
|
|
2304
|
+
"feature": "core",
|
|
2305
|
+
"responsibility": "gem",
|
|
2306
|
+
"status": "code_reviewed",
|
|
2307
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2308
|
+
"code_symbols": [
|
|
2309
|
+
"create_token",
|
|
2310
|
+
"id_token_claims"
|
|
2311
|
+
],
|
|
2312
|
+
"grouped_test_files": [
|
|
2313
|
+
"test/ciba_integration_test.rb",
|
|
2314
|
+
"test/ciba_conformance_test.rb"
|
|
2315
|
+
],
|
|
2316
|
+
"historical_status_not_current_evidence": "verified",
|
|
2317
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2318
|
+
},
|
|
2319
|
+
{
|
|
2320
|
+
"id": "CIBA-104",
|
|
2321
|
+
"section": "10.1.1",
|
|
2322
|
+
"requirement": "Return a token error instead of tokens when customer authentication/authorization has not succeeded.",
|
|
2323
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.1.1",
|
|
2324
|
+
"normative_level": "definition_or_guidance",
|
|
2325
|
+
"normative_detail": "応答定義（未認証・未承認時はerror、lowercase must）",
|
|
2326
|
+
"conditional": true,
|
|
2327
|
+
"feature": "core",
|
|
2328
|
+
"responsibility": "gem",
|
|
2329
|
+
"status": "code_reviewed",
|
|
2330
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2331
|
+
"code_symbols": [
|
|
2332
|
+
"create_token",
|
|
2333
|
+
"id_token_claims"
|
|
2334
|
+
],
|
|
2335
|
+
"grouped_test_files": [
|
|
2336
|
+
"test/ciba_integration_test.rb",
|
|
2337
|
+
"test/ciba_conformance_test.rb"
|
|
2338
|
+
],
|
|
2339
|
+
"historical_status_not_current_evidence": "verified",
|
|
2340
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2341
|
+
},
|
|
2342
|
+
{
|
|
2343
|
+
"id": "CIBA-105",
|
|
2344
|
+
"section": "10.2",
|
|
2345
|
+
"requirement": "After successful or failed authentication send ping callback as HTTP POST to the registered notification endpoint.",
|
|
2346
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2347
|
+
"normative_level": "definition_or_guidance",
|
|
2348
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
2349
|
+
"conditional": true,
|
|
2350
|
+
"feature": "ping",
|
|
2351
|
+
"responsibility": "gem",
|
|
2352
|
+
"status": "code_reviewed",
|
|
2353
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2354
|
+
"code_symbols": [],
|
|
2355
|
+
"grouped_test_files": [
|
|
2356
|
+
"test/ciba_ping_test.rb"
|
|
2357
|
+
],
|
|
2358
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2359
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2360
|
+
},
|
|
2361
|
+
{
|
|
2362
|
+
"id": "CIBA-106",
|
|
2363
|
+
"section": "10.2",
|
|
2364
|
+
"requirement": "Send client_notification_token as Authorization Bearer in ping callbacks.",
|
|
2365
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2366
|
+
"normative_level": "definition_or_guidance",
|
|
2367
|
+
"normative_detail": "配送形式の定義（ping対応時。MUSTという語ではない）",
|
|
2368
|
+
"conditional": true,
|
|
2369
|
+
"feature": "ping",
|
|
2370
|
+
"responsibility": "gem",
|
|
2371
|
+
"status": "code_reviewed",
|
|
2372
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2373
|
+
"code_symbols": [],
|
|
2374
|
+
"grouped_test_files": [
|
|
2375
|
+
"test/ciba_ping_test.rb"
|
|
2376
|
+
],
|
|
2377
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2378
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2379
|
+
},
|
|
2380
|
+
{
|
|
2381
|
+
"id": "CIBA-107",
|
|
2382
|
+
"section": "10.2",
|
|
2383
|
+
"requirement": "Send only auth_req_id as the ping JSON body.",
|
|
2384
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2385
|
+
"normative_level": "definition_or_guidance",
|
|
2386
|
+
"normative_detail": "配送形式の定義（ping対応時。MUSTという語ではない）",
|
|
2387
|
+
"conditional": true,
|
|
2388
|
+
"feature": "ping",
|
|
2389
|
+
"responsibility": "gem",
|
|
2390
|
+
"status": "code_reviewed",
|
|
2391
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2392
|
+
"code_symbols": [],
|
|
2393
|
+
"grouped_test_files": [
|
|
2394
|
+
"test/ciba_ping_test.rb"
|
|
2395
|
+
],
|
|
2396
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2397
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2398
|
+
},
|
|
2399
|
+
{
|
|
2400
|
+
"id": "CIBA-108",
|
|
2401
|
+
"section": "10.2",
|
|
2402
|
+
"requirement": "Client verifies notification token and its association with auth_req_id; invalid bearer should yield HTTP 401.",
|
|
2403
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2404
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2405
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2406
|
+
"conditional": true,
|
|
2407
|
+
"feature": "core",
|
|
2408
|
+
"responsibility": "client",
|
|
2409
|
+
"status": "client_duty",
|
|
2410
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2411
|
+
"code_symbols": [],
|
|
2412
|
+
"grouped_test_files": [
|
|
2413
|
+
"test/ciba_ping_test.rb"
|
|
2414
|
+
],
|
|
2415
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2416
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2417
|
+
},
|
|
2418
|
+
{
|
|
2419
|
+
"id": "CIBA-109",
|
|
2420
|
+
"section": "10.2",
|
|
2421
|
+
"requirement": "Accept callback HTTP 204 and also HTTP 200, ignoring response bodies.",
|
|
2422
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2423
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
2424
|
+
"normative_detail": "推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）",
|
|
2425
|
+
"conditional": true,
|
|
2426
|
+
"feature": "ping",
|
|
2427
|
+
"responsibility": "gem + client",
|
|
2428
|
+
"status": "code_reviewed",
|
|
2429
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2430
|
+
"code_symbols": [],
|
|
2431
|
+
"grouped_test_files": [
|
|
2432
|
+
"test/ciba_ping_test.rb"
|
|
2433
|
+
],
|
|
2434
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2435
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2436
|
+
},
|
|
2437
|
+
{
|
|
2438
|
+
"id": "CIBA-110",
|
|
2439
|
+
"section": "10.2",
|
|
2440
|
+
"requirement": "OP must not follow ping callback redirects.",
|
|
2441
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2442
|
+
"normative_level": "MUST_NOT",
|
|
2443
|
+
"normative_detail": "条件付き必須（該当機能/条件時 MUST）",
|
|
2444
|
+
"conditional": true,
|
|
2445
|
+
"feature": "ping",
|
|
2446
|
+
"responsibility": "gem",
|
|
2447
|
+
"status": "code_reviewed",
|
|
2448
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2449
|
+
"code_symbols": [],
|
|
2450
|
+
"grouped_test_files": [
|
|
2451
|
+
"test/ciba_ping_test.rb"
|
|
2452
|
+
],
|
|
2453
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2454
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2455
|
+
},
|
|
2456
|
+
{
|
|
2457
|
+
"id": "CIBA-111",
|
|
2458
|
+
"section": "10.2",
|
|
2459
|
+
"requirement": "After verifying notification, client retrieves tokens at token endpoint.",
|
|
2460
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.2",
|
|
2461
|
+
"normative_level": "definition_or_guidance",
|
|
2462
|
+
"normative_detail": "フローの説明（通知検証後にclient can retrieve、MUSTという語ではない）",
|
|
2463
|
+
"conditional": true,
|
|
2464
|
+
"feature": "core",
|
|
2465
|
+
"responsibility": "client",
|
|
2466
|
+
"status": "client_duty",
|
|
2467
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2468
|
+
"code_symbols": [],
|
|
2469
|
+
"grouped_test_files": [
|
|
2470
|
+
"test/ciba_ping_test.rb"
|
|
2471
|
+
],
|
|
2472
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2473
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2474
|
+
},
|
|
2475
|
+
{
|
|
2476
|
+
"id": "CIBA-112",
|
|
2477
|
+
"section": "9",
|
|
2478
|
+
"requirement": "Require HTTPS notification URLs and TLS communication for ping/push.",
|
|
2479
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.9",
|
|
2480
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2481
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2482
|
+
"conditional": true,
|
|
2483
|
+
"feature": "ping",
|
|
2484
|
+
"responsibility": "gem + client",
|
|
2485
|
+
"status": "code_reviewed",
|
|
2486
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2487
|
+
"code_symbols": [],
|
|
2488
|
+
"grouped_test_files": [
|
|
2489
|
+
"test/ciba_ping_test.rb",
|
|
2490
|
+
"test/ciba_http_test.rb"
|
|
2491
|
+
],
|
|
2492
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2493
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2494
|
+
},
|
|
2495
|
+
{
|
|
2496
|
+
"id": "CIBA-113",
|
|
2497
|
+
"section": "9",
|
|
2498
|
+
"requirement": "Authenticate notification requests using the client's client_notification_token.",
|
|
2499
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.9",
|
|
2500
|
+
"normative_level": "definition_or_guidance",
|
|
2501
|
+
"normative_detail": "配送認証の定義（lowercase must）",
|
|
2502
|
+
"conditional": true,
|
|
2503
|
+
"feature": "ping",
|
|
2504
|
+
"responsibility": "gem + client",
|
|
2505
|
+
"status": "code_reviewed",
|
|
2506
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2507
|
+
"code_symbols": [],
|
|
2508
|
+
"grouped_test_files": [
|
|
2509
|
+
"test/ciba_ping_test.rb",
|
|
2510
|
+
"test/ciba_http_test.rb"
|
|
2511
|
+
],
|
|
2512
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2513
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2514
|
+
},
|
|
2515
|
+
{
|
|
2516
|
+
"id": "CIBA-114",
|
|
2517
|
+
"section": "10.3.1",
|
|
2518
|
+
"requirement": "Send ID Token/access token/optional refresh token/auth_req_id as JSON to registered notification endpoint after authorization.",
|
|
2519
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2520
|
+
"normative_level": "definition_or_guidance",
|
|
2521
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
2522
|
+
"conditional": true,
|
|
2523
|
+
"feature": "push",
|
|
2524
|
+
"responsibility": "gem",
|
|
2525
|
+
"status": "not_applicable",
|
|
2526
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2527
|
+
"code_symbols": [],
|
|
2528
|
+
"grouped_test_files": [],
|
|
2529
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2530
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2531
|
+
},
|
|
2532
|
+
{
|
|
2533
|
+
"id": "CIBA-115",
|
|
2534
|
+
"section": "10.3.1",
|
|
2535
|
+
"requirement": "Include access-token hash at_hash in push ID Token.",
|
|
2536
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2537
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2538
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2539
|
+
"conditional": true,
|
|
2540
|
+
"feature": "push",
|
|
2541
|
+
"responsibility": "gem",
|
|
2542
|
+
"status": "not_applicable",
|
|
2543
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2544
|
+
"code_symbols": [],
|
|
2545
|
+
"grouped_test_files": [],
|
|
2546
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2547
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2548
|
+
},
|
|
2549
|
+
{
|
|
2550
|
+
"id": "CIBA-116",
|
|
2551
|
+
"section": "10.3.1",
|
|
2552
|
+
"requirement": "Include urn:openid:params:jwt:claim:auth_req_id in push ID Token.",
|
|
2553
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2554
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2555
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2556
|
+
"conditional": true,
|
|
2557
|
+
"feature": "push",
|
|
2558
|
+
"responsibility": "gem",
|
|
2559
|
+
"status": "not_applicable",
|
|
2560
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2561
|
+
"code_symbols": [],
|
|
2562
|
+
"grouped_test_files": [],
|
|
2563
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2564
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2565
|
+
},
|
|
2566
|
+
{
|
|
2567
|
+
"id": "CIBA-117",
|
|
2568
|
+
"section": "10.3.1",
|
|
2569
|
+
"requirement": "When pushing refresh token, include urn:openid:params:jwt:claim:rt_hash calculated like at_hash.",
|
|
2570
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2571
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2572
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2573
|
+
"conditional": true,
|
|
2574
|
+
"feature": "push",
|
|
2575
|
+
"responsibility": "gem",
|
|
2576
|
+
"status": "not_applicable",
|
|
2577
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2578
|
+
"code_symbols": [],
|
|
2579
|
+
"grouped_test_files": [],
|
|
2580
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2581
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2582
|
+
},
|
|
2583
|
+
{
|
|
2584
|
+
"id": "CIBA-118",
|
|
2585
|
+
"section": "10.3.1",
|
|
2586
|
+
"requirement": "Client validates bearer token, ID Token and correspondence of auth_req_id/access-token hash/refresh-token hash.",
|
|
2587
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2588
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2589
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2590
|
+
"conditional": true,
|
|
2591
|
+
"feature": "push",
|
|
2592
|
+
"responsibility": "client",
|
|
2593
|
+
"status": "client_duty",
|
|
2594
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2595
|
+
"code_symbols": [],
|
|
2596
|
+
"grouped_test_files": [],
|
|
2597
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2598
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2599
|
+
},
|
|
2600
|
+
{
|
|
2601
|
+
"id": "CIBA-119",
|
|
2602
|
+
"section": "10.3.1",
|
|
2603
|
+
"requirement": "OP accepts HTTP 204 and HTTP 200 callback responses and ignores their bodies.",
|
|
2604
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2605
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
2606
|
+
"normative_detail": "推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）",
|
|
2607
|
+
"conditional": true,
|
|
2608
|
+
"feature": "push",
|
|
2609
|
+
"responsibility": "gem",
|
|
2610
|
+
"status": "not_applicable",
|
|
2611
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2612
|
+
"code_symbols": [],
|
|
2613
|
+
"grouped_test_files": [],
|
|
2614
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2615
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2616
|
+
},
|
|
2617
|
+
{
|
|
2618
|
+
"id": "CIBA-120",
|
|
2619
|
+
"section": "10.3.1",
|
|
2620
|
+
"requirement": "OP must not follow push callback redirects.",
|
|
2621
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2622
|
+
"normative_level": "MUST_NOT",
|
|
2623
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2624
|
+
"conditional": true,
|
|
2625
|
+
"feature": "push",
|
|
2626
|
+
"responsibility": "gem",
|
|
2627
|
+
"status": "not_applicable",
|
|
2628
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2629
|
+
"code_symbols": [],
|
|
2630
|
+
"grouped_test_files": [],
|
|
2631
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2632
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2633
|
+
},
|
|
2634
|
+
{
|
|
2635
|
+
"id": "CIBA-121",
|
|
2636
|
+
"section": "10.3.1",
|
|
2637
|
+
"requirement": "Client ignores unrecognized push request parameters.",
|
|
2638
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.10.3.1",
|
|
2639
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2640
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2641
|
+
"conditional": true,
|
|
2642
|
+
"feature": "push",
|
|
2643
|
+
"responsibility": "client",
|
|
2644
|
+
"status": "client_duty",
|
|
2645
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2646
|
+
"code_symbols": [],
|
|
2647
|
+
"grouped_test_files": [],
|
|
2648
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2649
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2650
|
+
},
|
|
2651
|
+
{
|
|
2652
|
+
"id": "CIBA-122",
|
|
2653
|
+
"section": "11",
|
|
2654
|
+
"requirement": "Return invalid/unauthorized token request errors according to OIDC Core 3.1.3.4 and RFC6749 5.2.",
|
|
2655
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2656
|
+
"normative_level": "definition_or_guidance",
|
|
2657
|
+
"normative_detail": "必須（invalid/unauthorized errors must follow referenced OIDC/OAuth format; triggered by invalid request）",
|
|
2658
|
+
"conditional": false,
|
|
2659
|
+
"feature": "core",
|
|
2660
|
+
"responsibility": "gem",
|
|
2661
|
+
"status": "code_reviewed",
|
|
2662
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2663
|
+
"code_symbols": [
|
|
2664
|
+
"create_token",
|
|
2665
|
+
"ciba_http",
|
|
2666
|
+
"ciba_error"
|
|
2667
|
+
],
|
|
2668
|
+
"grouped_test_files": [
|
|
2669
|
+
"test/ciba_security_test.rb",
|
|
2670
|
+
"test/ciba_integration_test.rb"
|
|
2671
|
+
],
|
|
2672
|
+
"historical_status_not_current_evidence": "verified",
|
|
2673
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2674
|
+
},
|
|
2675
|
+
{
|
|
2676
|
+
"id": "CIBA-123",
|
|
2677
|
+
"section": "11",
|
|
2678
|
+
"requirement": "Return authorization_pending while authentication/authorization is pending.",
|
|
2679
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2680
|
+
"normative_level": "definition_or_guidance",
|
|
2681
|
+
"normative_detail": "必須（pending response state; normative error semantics）",
|
|
2682
|
+
"conditional": false,
|
|
2683
|
+
"feature": "core",
|
|
2684
|
+
"responsibility": "gem",
|
|
2685
|
+
"status": "code_reviewed",
|
|
2686
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2687
|
+
"code_symbols": [
|
|
2688
|
+
"create_token",
|
|
2689
|
+
"ciba_http",
|
|
2690
|
+
"ciba_error"
|
|
2691
|
+
],
|
|
2692
|
+
"grouped_test_files": [
|
|
2693
|
+
"test/ciba_security_test.rb",
|
|
2694
|
+
"test/ciba_integration_test.rb"
|
|
2695
|
+
],
|
|
2696
|
+
"historical_status_not_current_evidence": "verified",
|
|
2697
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2698
|
+
},
|
|
2699
|
+
{
|
|
2700
|
+
"id": "CIBA-124",
|
|
2701
|
+
"section": "11",
|
|
2702
|
+
"requirement": "For too-fast pending polling return slow_down and increase interval by at least five seconds for subsequent requests.",
|
|
2703
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2704
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2705
|
+
"normative_detail": "条件付き必須（slow_down応答なら interval MUST increase by >=5 seconds）",
|
|
2706
|
+
"conditional": false,
|
|
2707
|
+
"feature": "core",
|
|
2708
|
+
"responsibility": "gem",
|
|
2709
|
+
"status": "code_reviewed",
|
|
2710
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2711
|
+
"code_symbols": [
|
|
2712
|
+
"create_token",
|
|
2713
|
+
"ciba_http",
|
|
2714
|
+
"ciba_error"
|
|
2715
|
+
],
|
|
2716
|
+
"grouped_test_files": [
|
|
2717
|
+
"test/ciba_security_test.rb",
|
|
2718
|
+
"test/ciba_integration_test.rb"
|
|
2719
|
+
],
|
|
2720
|
+
"historical_status_not_current_evidence": "verified",
|
|
2721
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2722
|
+
},
|
|
2723
|
+
{
|
|
2724
|
+
"id": "CIBA-125",
|
|
2725
|
+
"section": "11",
|
|
2726
|
+
"requirement": "Return expired_token when auth_req_id has expired.",
|
|
2727
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2728
|
+
"normative_level": "definition_or_guidance",
|
|
2729
|
+
"normative_detail": "エラー定義（§11 poll/pingのexpired_token。§12 pushの送信任意とは別）",
|
|
2730
|
+
"conditional": true,
|
|
2731
|
+
"feature": "core",
|
|
2732
|
+
"responsibility": "gem",
|
|
2733
|
+
"status": "code_reviewed",
|
|
2734
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2735
|
+
"code_symbols": [
|
|
2736
|
+
"create_token",
|
|
2737
|
+
"ciba_http",
|
|
2738
|
+
"ciba_error"
|
|
2739
|
+
],
|
|
2740
|
+
"grouped_test_files": [
|
|
2741
|
+
"test/ciba_security_test.rb",
|
|
2742
|
+
"test/ciba_integration_test.rb"
|
|
2743
|
+
],
|
|
2744
|
+
"historical_status_not_current_evidence": "verified",
|
|
2745
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2746
|
+
},
|
|
2747
|
+
{
|
|
2748
|
+
"id": "CIBA-126",
|
|
2749
|
+
"section": "11",
|
|
2750
|
+
"requirement": "Return access_denied when end-user denied authorization.",
|
|
2751
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2752
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2753
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2754
|
+
"conditional": true,
|
|
2755
|
+
"feature": "core",
|
|
2756
|
+
"responsibility": "gem",
|
|
2757
|
+
"status": "code_reviewed",
|
|
2758
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2759
|
+
"code_symbols": [
|
|
2760
|
+
"create_token",
|
|
2761
|
+
"ciba_http",
|
|
2762
|
+
"ciba_error"
|
|
2763
|
+
],
|
|
2764
|
+
"grouped_test_files": [
|
|
2765
|
+
"test/ciba_security_test.rb",
|
|
2766
|
+
"test/ciba_integration_test.rb"
|
|
2767
|
+
],
|
|
2768
|
+
"historical_status_not_current_evidence": "verified",
|
|
2769
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2770
|
+
},
|
|
2771
|
+
{
|
|
2772
|
+
"id": "CIBA-127",
|
|
2773
|
+
"section": "11",
|
|
2774
|
+
"requirement": "Return invalid_grant for invalid auth_req_id or one issued to a different client.",
|
|
2775
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2776
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2777
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2778
|
+
"conditional": false,
|
|
2779
|
+
"feature": "core",
|
|
2780
|
+
"responsibility": "gem",
|
|
2781
|
+
"status": "code_reviewed",
|
|
2782
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2783
|
+
"code_symbols": [
|
|
2784
|
+
"create_token",
|
|
2785
|
+
"ciba_http",
|
|
2786
|
+
"ciba_error"
|
|
2787
|
+
],
|
|
2788
|
+
"grouped_test_files": [
|
|
2789
|
+
"test/ciba_security_test.rb",
|
|
2790
|
+
"test/ciba_integration_test.rb"
|
|
2791
|
+
],
|
|
2792
|
+
"historical_status_not_current_evidence": "verified",
|
|
2793
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2794
|
+
},
|
|
2795
|
+
{
|
|
2796
|
+
"id": "CIBA-128",
|
|
2797
|
+
"section": "11",
|
|
2798
|
+
"requirement": "OP may return invalid_request for continued too-fast polling; evaluate optional capability.",
|
|
2799
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2800
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
2801
|
+
"normative_detail": "任意（OP MAY send invalid_request on continued too-fast polling）",
|
|
2802
|
+
"conditional": true,
|
|
2803
|
+
"feature": "core",
|
|
2804
|
+
"responsibility": "gem",
|
|
2805
|
+
"status": "optional_not_implemented",
|
|
2806
|
+
"acceptance_gate": "Optional termination of abusive polling not offered",
|
|
2807
|
+
"code_symbols": [],
|
|
2808
|
+
"grouped_test_files": [
|
|
2809
|
+
"test/ciba_security_test.rb",
|
|
2810
|
+
"test/ciba_integration_test.rb"
|
|
2811
|
+
],
|
|
2812
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2813
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2814
|
+
},
|
|
2815
|
+
{
|
|
2816
|
+
"id": "CIBA-129",
|
|
2817
|
+
"section": "11",
|
|
2818
|
+
"requirement": "Client must stop requesting the same auth_req_id after invalid_request.",
|
|
2819
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2820
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2821
|
+
"normative_detail": "必須（client MUST stop same auth_req_id after invalid_request）",
|
|
2822
|
+
"conditional": false,
|
|
2823
|
+
"feature": "core",
|
|
2824
|
+
"responsibility": "client",
|
|
2825
|
+
"status": "client_duty",
|
|
2826
|
+
"acceptance_gate": "RP implementation outside this OP extension",
|
|
2827
|
+
"code_symbols": [],
|
|
2828
|
+
"grouped_test_files": [
|
|
2829
|
+
"test/ciba_security_test.rb",
|
|
2830
|
+
"test/ciba_integration_test.rb"
|
|
2831
|
+
],
|
|
2832
|
+
"historical_status_not_current_evidence": "client_only",
|
|
2833
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2834
|
+
},
|
|
2835
|
+
{
|
|
2836
|
+
"id": "CIBA-130",
|
|
2837
|
+
"section": "11",
|
|
2838
|
+
"requirement": "Reject CIBA token requests by a client configured for push with unauthorized_client.",
|
|
2839
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.11",
|
|
2840
|
+
"normative_level": "MUST_NOT",
|
|
2841
|
+
"normative_detail": "条件付き必須（push client MUST NOT token endpoint call; unauthorized_client required）",
|
|
2842
|
+
"conditional": true,
|
|
2843
|
+
"feature": "core",
|
|
2844
|
+
"responsibility": "gem",
|
|
2845
|
+
"status": "code_reviewed",
|
|
2846
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2847
|
+
"code_symbols": [
|
|
2848
|
+
"validate_token_params",
|
|
2849
|
+
"ciba_client_eligible?"
|
|
2850
|
+
],
|
|
2851
|
+
"grouped_test_files": [
|
|
2852
|
+
"test/ciba_security_test.rb",
|
|
2853
|
+
"test/ciba_integration_test.rb"
|
|
2854
|
+
],
|
|
2855
|
+
"historical_status_not_current_evidence": "verified",
|
|
2856
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2857
|
+
},
|
|
2858
|
+
{
|
|
2859
|
+
"id": "CIBA-131",
|
|
2860
|
+
"section": "12",
|
|
2861
|
+
"requirement": "Deliver push errors as application/json with required error and auth_req_id.",
|
|
2862
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.12",
|
|
2863
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2864
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2865
|
+
"conditional": true,
|
|
2866
|
+
"feature": "push",
|
|
2867
|
+
"responsibility": "gem",
|
|
2868
|
+
"status": "not_applicable",
|
|
2869
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2870
|
+
"code_symbols": [],
|
|
2871
|
+
"grouped_test_files": [],
|
|
2872
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2873
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2874
|
+
},
|
|
2875
|
+
{
|
|
2876
|
+
"id": "CIBA-132",
|
|
2877
|
+
"section": "12",
|
|
2878
|
+
"requirement": "If push error_description is supplied, limit it to the specified ASCII character ranges.",
|
|
2879
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.12",
|
|
2880
|
+
"normative_level": "MUST_NOT",
|
|
2881
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2882
|
+
"conditional": true,
|
|
2883
|
+
"feature": "push",
|
|
2884
|
+
"responsibility": "gem",
|
|
2885
|
+
"status": "not_applicable",
|
|
2886
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2887
|
+
"code_symbols": [],
|
|
2888
|
+
"grouped_test_files": [],
|
|
2889
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2890
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2891
|
+
},
|
|
2892
|
+
{
|
|
2893
|
+
"id": "CIBA-133",
|
|
2894
|
+
"section": "12",
|
|
2895
|
+
"requirement": "Deliver access_denied push error when end-user refuses authorization.",
|
|
2896
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.12",
|
|
2897
|
+
"normative_level": "definition_or_guidance",
|
|
2898
|
+
"normative_detail": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
|
|
2899
|
+
"conditional": true,
|
|
2900
|
+
"feature": "push",
|
|
2901
|
+
"responsibility": "gem",
|
|
2902
|
+
"status": "not_applicable",
|
|
2903
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2904
|
+
"code_symbols": [],
|
|
2905
|
+
"grouped_test_files": [],
|
|
2906
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2907
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2908
|
+
},
|
|
2909
|
+
{
|
|
2910
|
+
"id": "CIBA-134",
|
|
2911
|
+
"section": "12",
|
|
2912
|
+
"requirement": "Optionally deliver expired_token push error when authentication request expires.",
|
|
2913
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.12",
|
|
2914
|
+
"normative_level": "OPTIONAL_or_MAY",
|
|
2915
|
+
"normative_detail": "任意（OP not required to send expired_token push error）",
|
|
2916
|
+
"conditional": true,
|
|
2917
|
+
"feature": "push",
|
|
2918
|
+
"responsibility": "gem",
|
|
2919
|
+
"status": "not_applicable",
|
|
2920
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2921
|
+
"code_symbols": [],
|
|
2922
|
+
"grouped_test_files": [],
|
|
2923
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2924
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2925
|
+
},
|
|
2926
|
+
{
|
|
2927
|
+
"id": "CIBA-135",
|
|
2928
|
+
"section": "12",
|
|
2929
|
+
"requirement": "Deliver transaction_failed for unexpected unsuccessful push transactions.",
|
|
2930
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.12",
|
|
2931
|
+
"normative_level": "definition_or_guidance",
|
|
2932
|
+
"normative_detail": "任意のエラー通知（push transaction_failedを利用できる。全失敗への送信義務ではない）",
|
|
2933
|
+
"conditional": true,
|
|
2934
|
+
"feature": "push",
|
|
2935
|
+
"responsibility": "gem",
|
|
2936
|
+
"status": "not_applicable",
|
|
2937
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
2938
|
+
"code_symbols": [],
|
|
2939
|
+
"grouped_test_files": [],
|
|
2940
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
2941
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2942
|
+
},
|
|
2943
|
+
{
|
|
2944
|
+
"id": "CIBA-136",
|
|
2945
|
+
"section": "13",
|
|
2946
|
+
"requirement": "Return authentication errors with application/json and a required ASCII error code.",
|
|
2947
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
2948
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2949
|
+
"normative_detail": "必須（MUST / REQUIRED）",
|
|
2950
|
+
"conditional": false,
|
|
2951
|
+
"feature": "core",
|
|
2952
|
+
"responsibility": "gem",
|
|
2953
|
+
"status": "code_reviewed",
|
|
2954
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2955
|
+
"code_symbols": [
|
|
2956
|
+
"ciba_http",
|
|
2957
|
+
"ciba_error"
|
|
2958
|
+
],
|
|
2959
|
+
"grouped_test_files": [
|
|
2960
|
+
"test/ciba_requirements_test.rb",
|
|
2961
|
+
"test/ciba_user_code_test.rb"
|
|
2962
|
+
],
|
|
2963
|
+
"historical_status_not_current_evidence": "verified",
|
|
2964
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2965
|
+
},
|
|
2966
|
+
{
|
|
2967
|
+
"id": "CIBA-137",
|
|
2968
|
+
"section": "13",
|
|
2969
|
+
"requirement": "If authentication error_description is emitted, enforce the specified ASCII ranges.",
|
|
2970
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
2971
|
+
"normative_level": "MUST_NOT",
|
|
2972
|
+
"normative_detail": "条件付き必須（任意のerror_descriptionを出す場合のMUST NOT文字制約）",
|
|
2973
|
+
"conditional": true,
|
|
2974
|
+
"feature": "core",
|
|
2975
|
+
"responsibility": "gem",
|
|
2976
|
+
"status": "code_reviewed",
|
|
2977
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
2978
|
+
"code_symbols": [
|
|
2979
|
+
"ciba_http",
|
|
2980
|
+
"ciba_error"
|
|
2981
|
+
],
|
|
2982
|
+
"grouped_test_files": [
|
|
2983
|
+
"test/ciba_requirements_test.rb",
|
|
2984
|
+
"test/ciba_user_code_test.rb"
|
|
2985
|
+
],
|
|
2986
|
+
"historical_status_not_current_evidence": "verified",
|
|
2987
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
2988
|
+
},
|
|
2989
|
+
{
|
|
2990
|
+
"id": "CIBA-138",
|
|
2991
|
+
"section": "13",
|
|
2992
|
+
"requirement": "If error_uri is emitted, enforce URI-reference syntax and specified ASCII ranges.",
|
|
2993
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
2994
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
2995
|
+
"normative_detail": "条件付き必須（任意のerror_uriを出す場合のMUST構文制約）",
|
|
2996
|
+
"conditional": true,
|
|
2997
|
+
"feature": "core",
|
|
2998
|
+
"responsibility": "gem",
|
|
2999
|
+
"status": "not_applicable",
|
|
3000
|
+
"acceptance_gate": "error_uri is not emitted",
|
|
3001
|
+
"code_symbols": [
|
|
3002
|
+
"ciba_http",
|
|
3003
|
+
"ciba_error"
|
|
3004
|
+
],
|
|
3005
|
+
"grouped_test_files": [
|
|
3006
|
+
"test/ciba_requirements_test.rb",
|
|
3007
|
+
"test/ciba_user_code_test.rb"
|
|
3008
|
+
],
|
|
3009
|
+
"historical_status_not_current_evidence": "verified",
|
|
3010
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3011
|
+
},
|
|
3012
|
+
{
|
|
3013
|
+
"id": "CIBA-139",
|
|
3014
|
+
"section": "13",
|
|
3015
|
+
"requirement": "Use HTTP 400 invalid_request for missing/invalid/repeated parameters and multiple hints.",
|
|
3016
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3017
|
+
"normative_level": "definition_or_guidance",
|
|
3018
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3019
|
+
"conditional": false,
|
|
3020
|
+
"feature": "core",
|
|
3021
|
+
"responsibility": "gem",
|
|
3022
|
+
"status": "code_reviewed",
|
|
3023
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3024
|
+
"code_symbols": [
|
|
3025
|
+
"ciba_http",
|
|
3026
|
+
"ciba_error"
|
|
3027
|
+
],
|
|
3028
|
+
"grouped_test_files": [
|
|
3029
|
+
"test/ciba_requirements_test.rb",
|
|
3030
|
+
"test/ciba_user_code_test.rb"
|
|
3031
|
+
],
|
|
3032
|
+
"historical_status_not_current_evidence": "verified",
|
|
3033
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3034
|
+
},
|
|
3035
|
+
{
|
|
3036
|
+
"id": "CIBA-140",
|
|
3037
|
+
"section": "13",
|
|
3038
|
+
"requirement": "Use HTTP 400 invalid_scope for malformed, unknown or invalid scope.",
|
|
3039
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3040
|
+
"normative_level": "definition_or_guidance",
|
|
3041
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3042
|
+
"conditional": false,
|
|
3043
|
+
"feature": "core",
|
|
3044
|
+
"responsibility": "gem",
|
|
3045
|
+
"status": "code_reviewed",
|
|
3046
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3047
|
+
"code_symbols": [
|
|
3048
|
+
"ciba_http",
|
|
3049
|
+
"ciba_error"
|
|
3050
|
+
],
|
|
3051
|
+
"grouped_test_files": [
|
|
3052
|
+
"test/ciba_requirements_test.rb",
|
|
3053
|
+
"test/ciba_user_code_test.rb"
|
|
3054
|
+
],
|
|
3055
|
+
"historical_status_not_current_evidence": "verified",
|
|
3056
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3057
|
+
},
|
|
3058
|
+
{
|
|
3059
|
+
"id": "CIBA-141",
|
|
3060
|
+
"section": "13",
|
|
3061
|
+
"requirement": "Use HTTP 400 expired_login_hint_token for an expired login_hint_token when supported.",
|
|
3062
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3063
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
3064
|
+
"normative_detail": "条件付き必須（supported login_hint_token expired case; otherwise feature optional）",
|
|
3065
|
+
"conditional": true,
|
|
3066
|
+
"feature": "login_hint_token",
|
|
3067
|
+
"responsibility": "gem",
|
|
3068
|
+
"status": "code_reviewed",
|
|
3069
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3070
|
+
"code_symbols": [],
|
|
3071
|
+
"grouped_test_files": [
|
|
3072
|
+
"test/ciba_requirements_test.rb",
|
|
3073
|
+
"test/ciba_user_code_test.rb"
|
|
3074
|
+
],
|
|
3075
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3076
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3077
|
+
},
|
|
3078
|
+
{
|
|
3079
|
+
"id": "CIBA-142",
|
|
3080
|
+
"section": "13",
|
|
3081
|
+
"requirement": "Use HTTP 400 unknown_user_id when supported hints cannot identify the intended user.",
|
|
3082
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3083
|
+
"normative_level": "definition_or_guidance",
|
|
3084
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3085
|
+
"conditional": true,
|
|
3086
|
+
"feature": "core",
|
|
3087
|
+
"responsibility": "gem",
|
|
3088
|
+
"status": "code_reviewed",
|
|
3089
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3090
|
+
"code_symbols": [
|
|
3091
|
+
"ciba_http",
|
|
3092
|
+
"ciba_error"
|
|
3093
|
+
],
|
|
3094
|
+
"grouped_test_files": [
|
|
3095
|
+
"test/ciba_requirements_test.rb",
|
|
3096
|
+
"test/ciba_user_code_test.rb"
|
|
3097
|
+
],
|
|
3098
|
+
"historical_status_not_current_evidence": "verified",
|
|
3099
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3100
|
+
},
|
|
3101
|
+
{
|
|
3102
|
+
"id": "CIBA-143",
|
|
3103
|
+
"section": "13",
|
|
3104
|
+
"requirement": "Use HTTP 400 unauthorized_client when a client is not allowed to use CIBA.",
|
|
3105
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3106
|
+
"normative_level": "definition_or_guidance",
|
|
3107
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3108
|
+
"conditional": true,
|
|
3109
|
+
"feature": "core",
|
|
3110
|
+
"responsibility": "gem",
|
|
3111
|
+
"status": "code_reviewed",
|
|
3112
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3113
|
+
"code_symbols": [
|
|
3114
|
+
"ciba_http",
|
|
3115
|
+
"ciba_error"
|
|
3116
|
+
],
|
|
3117
|
+
"grouped_test_files": [
|
|
3118
|
+
"test/ciba_requirements_test.rb",
|
|
3119
|
+
"test/ciba_user_code_test.rb"
|
|
3120
|
+
],
|
|
3121
|
+
"historical_status_not_current_evidence": "verified",
|
|
3122
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3123
|
+
},
|
|
3124
|
+
{
|
|
3125
|
+
"id": "CIBA-144",
|
|
3126
|
+
"section": "13",
|
|
3127
|
+
"requirement": "Use HTTP 400 missing_user_code when required user_code is absent.",
|
|
3128
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3129
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
3130
|
+
"normative_detail": "条件付き必須（if user_code is required and absent）",
|
|
3131
|
+
"conditional": true,
|
|
3132
|
+
"feature": "user_code",
|
|
3133
|
+
"responsibility": "gem",
|
|
3134
|
+
"status": "code_reviewed",
|
|
3135
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3136
|
+
"code_symbols": [],
|
|
3137
|
+
"grouped_test_files": [
|
|
3138
|
+
"test/ciba_requirements_test.rb",
|
|
3139
|
+
"test/ciba_user_code_test.rb"
|
|
3140
|
+
],
|
|
3141
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3142
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3143
|
+
},
|
|
3144
|
+
{
|
|
3145
|
+
"id": "CIBA-145",
|
|
3146
|
+
"section": "13",
|
|
3147
|
+
"requirement": "Use HTTP 400 invalid_user_code for invalid supplied user_code when supported.",
|
|
3148
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3149
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
3150
|
+
"normative_detail": "条件付き必須（if user_code supplied and invalid, where supported）",
|
|
3151
|
+
"conditional": true,
|
|
3152
|
+
"feature": "user_code",
|
|
3153
|
+
"responsibility": "gem",
|
|
3154
|
+
"status": "code_reviewed",
|
|
3155
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3156
|
+
"code_symbols": [],
|
|
3157
|
+
"grouped_test_files": [
|
|
3158
|
+
"test/ciba_requirements_test.rb",
|
|
3159
|
+
"test/ciba_user_code_test.rb"
|
|
3160
|
+
],
|
|
3161
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3162
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3163
|
+
},
|
|
3164
|
+
{
|
|
3165
|
+
"id": "CIBA-146",
|
|
3166
|
+
"section": "13",
|
|
3167
|
+
"requirement": "Use HTTP 400 invalid_binding_message for an unacceptable binding message.",
|
|
3168
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3169
|
+
"normative_level": "definition_or_guidance",
|
|
3170
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3171
|
+
"conditional": false,
|
|
3172
|
+
"feature": "core",
|
|
3173
|
+
"responsibility": "gem",
|
|
3174
|
+
"status": "code_reviewed",
|
|
3175
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3176
|
+
"code_symbols": [
|
|
3177
|
+
"ciba_http",
|
|
3178
|
+
"ciba_error"
|
|
3179
|
+
],
|
|
3180
|
+
"grouped_test_files": [
|
|
3181
|
+
"test/ciba_requirements_test.rb",
|
|
3182
|
+
"test/ciba_user_code_test.rb"
|
|
3183
|
+
],
|
|
3184
|
+
"historical_status_not_current_evidence": "verified",
|
|
3185
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3186
|
+
},
|
|
3187
|
+
{
|
|
3188
|
+
"id": "CIBA-147",
|
|
3189
|
+
"section": "13",
|
|
3190
|
+
"requirement": "Use HTTP 401 invalid_client for failed, absent or unsupported client authentication.",
|
|
3191
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3192
|
+
"normative_level": "definition_or_guidance",
|
|
3193
|
+
"normative_detail": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
|
|
3194
|
+
"conditional": false,
|
|
3195
|
+
"feature": "core",
|
|
3196
|
+
"responsibility": "gem",
|
|
3197
|
+
"status": "code_reviewed",
|
|
3198
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3199
|
+
"code_symbols": [
|
|
3200
|
+
"ciba_http",
|
|
3201
|
+
"ciba_error"
|
|
3202
|
+
],
|
|
3203
|
+
"grouped_test_files": [
|
|
3204
|
+
"test/ciba_requirements_test.rb",
|
|
3205
|
+
"test/ciba_user_code_test.rb"
|
|
3206
|
+
],
|
|
3207
|
+
"historical_status_not_current_evidence": "verified",
|
|
3208
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3209
|
+
},
|
|
3210
|
+
{
|
|
3211
|
+
"id": "CIBA-148",
|
|
3212
|
+
"section": "13",
|
|
3213
|
+
"requirement": "When OP/resource-owner policy denies an authentication request before user interaction, return HTTP 403 access_denied.",
|
|
3214
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.13",
|
|
3215
|
+
"normative_level": "MUST_or_REQUIRED",
|
|
3216
|
+
"normative_detail": "条件付き必須（when OP/resource-owner pre-interaction policy denies）",
|
|
3217
|
+
"conditional": true,
|
|
3218
|
+
"feature": "core",
|
|
3219
|
+
"responsibility": "gem + app",
|
|
3220
|
+
"status": "application_contract",
|
|
3221
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
3222
|
+
"code_symbols": [
|
|
3223
|
+
"ciba_http",
|
|
3224
|
+
"ciba_error"
|
|
3225
|
+
],
|
|
3226
|
+
"grouped_test_files": [
|
|
3227
|
+
"test/ciba_requirements_test.rb",
|
|
3228
|
+
"test/ciba_user_code_test.rb"
|
|
3229
|
+
],
|
|
3230
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
3231
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3232
|
+
},
|
|
3233
|
+
{
|
|
3234
|
+
"id": "CIBA-149",
|
|
3235
|
+
"section": "14",
|
|
3236
|
+
"requirement": "When supporting login_hint_token, it should be digitally signed by its issuer.",
|
|
3237
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3238
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
3239
|
+
"normative_detail": "Recommendation (SHOULD)",
|
|
3240
|
+
"conditional": true,
|
|
3241
|
+
"feature": "login_hint_token",
|
|
3242
|
+
"responsibility": "gem",
|
|
3243
|
+
"status": "code_reviewed",
|
|
3244
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3245
|
+
"code_symbols": [],
|
|
3246
|
+
"grouped_test_files": [
|
|
3247
|
+
"test/ciba_hint_token_test.rb",
|
|
3248
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3249
|
+
"test/ciba_http_test.rb"
|
|
3250
|
+
],
|
|
3251
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3252
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3253
|
+
},
|
|
3254
|
+
{
|
|
3255
|
+
"id": "CIBA-150",
|
|
3256
|
+
"section": "14",
|
|
3257
|
+
"requirement": "OP should ensure registered notification endpoint is under the client's administrative authority.",
|
|
3258
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3259
|
+
"normative_level": "SHOULD_or_RECOMMENDED",
|
|
3260
|
+
"normative_detail": "Recommendation (SHOULD)",
|
|
3261
|
+
"conditional": true,
|
|
3262
|
+
"feature": "core",
|
|
3263
|
+
"responsibility": "app",
|
|
3264
|
+
"status": "application_contract",
|
|
3265
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
3266
|
+
"code_symbols": [],
|
|
3267
|
+
"grouped_test_files": [
|
|
3268
|
+
"test/ciba_hint_token_test.rb",
|
|
3269
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3270
|
+
"test/ciba_http_test.rb"
|
|
3271
|
+
],
|
|
3272
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3273
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3274
|
+
},
|
|
3275
|
+
{
|
|
3276
|
+
"id": "CIBA-151",
|
|
3277
|
+
"section": "14",
|
|
3278
|
+
"requirement": "When supporting id_token_hint, accept expired ID Tokens for a reasonable period under the specified contextual validation policy.",
|
|
3279
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3280
|
+
"normative_level": "definition_or_guidance",
|
|
3281
|
+
"normative_detail": "任意（id_token_hint optional; text accept-expired policy is SHOULD within support）",
|
|
3282
|
+
"conditional": true,
|
|
3283
|
+
"feature": "id_token_hint",
|
|
3284
|
+
"responsibility": "gem",
|
|
3285
|
+
"status": "code_reviewed",
|
|
3286
|
+
"acceptance_gate": "Optional hint feature; expired-hint retention guidance uses lowercase should, not RFC2119 SHOULD",
|
|
3287
|
+
"code_symbols": [],
|
|
3288
|
+
"grouped_test_files": [
|
|
3289
|
+
"test/ciba_hint_token_test.rb",
|
|
3290
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3291
|
+
"test/ciba_http_test.rb"
|
|
3292
|
+
],
|
|
3293
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3294
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3295
|
+
},
|
|
3296
|
+
{
|
|
3297
|
+
"id": "CIBA-152",
|
|
3298
|
+
"section": "14",
|
|
3299
|
+
"requirement": "When supporting id_token_hint, verify OP issuer and that presenting client is listed in audience.",
|
|
3300
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3301
|
+
"normative_level": "definition_or_guidance",
|
|
3302
|
+
"normative_detail": "Guidance (lowercase should in source; not RFC2119 SHOULD)",
|
|
3303
|
+
"conditional": true,
|
|
3304
|
+
"feature": "id_token_hint",
|
|
3305
|
+
"responsibility": "gem",
|
|
3306
|
+
"status": "code_reviewed",
|
|
3307
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3308
|
+
"code_symbols": [],
|
|
3309
|
+
"grouped_test_files": [
|
|
3310
|
+
"test/ciba_hint_token_test.rb",
|
|
3311
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3312
|
+
"test/ciba_http_test.rb"
|
|
3313
|
+
],
|
|
3314
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3315
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3316
|
+
},
|
|
3317
|
+
{
|
|
3318
|
+
"id": "CIBA-153",
|
|
3319
|
+
"section": "14",
|
|
3320
|
+
"requirement": "When supporting id_token_hint, verify signature subject to the key rotation/pairwise alternatives discussed in section 14.",
|
|
3321
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3322
|
+
"normative_level": "definition_or_guidance",
|
|
3323
|
+
"normative_detail": "Guidance (lowercase should in source; not RFC2119 SHOULD)",
|
|
3324
|
+
"conditional": true,
|
|
3325
|
+
"feature": "id_token_hint",
|
|
3326
|
+
"responsibility": "gem",
|
|
3327
|
+
"status": "code_reviewed",
|
|
3328
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3329
|
+
"code_symbols": [],
|
|
3330
|
+
"grouped_test_files": [
|
|
3331
|
+
"test/ciba_hint_token_test.rb",
|
|
3332
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3333
|
+
"test/ciba_http_test.rb"
|
|
3334
|
+
],
|
|
3335
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3336
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3337
|
+
},
|
|
3338
|
+
{
|
|
3339
|
+
"id": "CIBA-154",
|
|
3340
|
+
"section": "14",
|
|
3341
|
+
"requirement": "For push, secure notification endpoint and its registration and consider sender-constrained tokens.",
|
|
3342
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3343
|
+
"normative_level": "definition_or_guidance",
|
|
3344
|
+
"normative_detail": "記述的要件（security considerations say secure endpoint / consider binding; catalog groups considerations）",
|
|
3345
|
+
"conditional": true,
|
|
3346
|
+
"feature": "push",
|
|
3347
|
+
"responsibility": "app",
|
|
3348
|
+
"status": "not_applicable",
|
|
3349
|
+
"acceptance_gate": "Push is neither implemented nor advertised",
|
|
3350
|
+
"code_symbols": [],
|
|
3351
|
+
"grouped_test_files": [
|
|
3352
|
+
"test/ciba_hint_token_test.rb",
|
|
3353
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3354
|
+
"test/ciba_http_test.rb"
|
|
3355
|
+
],
|
|
3356
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3357
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3358
|
+
},
|
|
3359
|
+
{
|
|
3360
|
+
"id": "CIBA-155",
|
|
3361
|
+
"section": "14",
|
|
3362
|
+
"requirement": "Additional RP session context metadata may be conveyed by deployment-specific means; CIBA specifies no mandatory transport for it.",
|
|
3363
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.14",
|
|
3364
|
+
"normative_level": "definition_or_guidance",
|
|
3365
|
+
"normative_detail": "参考情報（deployment-specific metadata may be conveyed; no CIBA transport requirement）",
|
|
3366
|
+
"conditional": false,
|
|
3367
|
+
"feature": "core",
|
|
3368
|
+
"responsibility": "app",
|
|
3369
|
+
"status": "application_contract",
|
|
3370
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
3371
|
+
"code_symbols": [
|
|
3372
|
+
"resolve_ciba_login_hint",
|
|
3373
|
+
"ciba_account_eligible?"
|
|
3374
|
+
],
|
|
3375
|
+
"grouped_test_files": [
|
|
3376
|
+
"test/ciba_hint_token_test.rb",
|
|
3377
|
+
"test/ciba_id_token_hint_test.rb",
|
|
3378
|
+
"test/ciba_http_test.rb"
|
|
3379
|
+
],
|
|
3380
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
3381
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3382
|
+
},
|
|
3383
|
+
{
|
|
3384
|
+
"id": "CIBA-156",
|
|
3385
|
+
"section": "15",
|
|
3386
|
+
"requirement": "Permit alternatives to global static identifiers; evaluate gem ability to use an app-defined privacy-preserving login_hint and boundaries of unsupported hint tokens.",
|
|
3387
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.15",
|
|
3388
|
+
"normative_level": "definition_or_guidance",
|
|
3389
|
+
"normative_detail": "参考情報（privacy considerations, no explicit MUST/SHOULD in cataloged behavior）",
|
|
3390
|
+
"conditional": false,
|
|
3391
|
+
"feature": "core",
|
|
3392
|
+
"responsibility": "app",
|
|
3393
|
+
"status": "application_contract",
|
|
3394
|
+
"acceptance_gate": "Application must enforce and integration-test this requirement",
|
|
3395
|
+
"code_symbols": [
|
|
3396
|
+
"resolve_ciba_login_hint"
|
|
3397
|
+
],
|
|
3398
|
+
"grouped_test_files": [],
|
|
3399
|
+
"historical_status_not_current_evidence": "app_contract",
|
|
3400
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3401
|
+
},
|
|
3402
|
+
{
|
|
3403
|
+
"id": "CIBA-157",
|
|
3404
|
+
"section": "15",
|
|
3405
|
+
"requirement": "Support the described privacy option of using a previously issued pairwise ID Token without personal data as id_token_hint.",
|
|
3406
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.15",
|
|
3407
|
+
"normative_level": "definition_or_guidance",
|
|
3408
|
+
"normative_detail": "参考情報（privacy option descriptive, not an OP mandate）",
|
|
3409
|
+
"conditional": true,
|
|
3410
|
+
"feature": "core",
|
|
3411
|
+
"responsibility": "gem",
|
|
3412
|
+
"status": "experimental_unverified",
|
|
3413
|
+
"acceptance_gate": "Pairwise/DCR disabled by default; outside supported release",
|
|
3414
|
+
"code_symbols": [],
|
|
3415
|
+
"grouped_test_files": [],
|
|
3416
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3417
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3418
|
+
},
|
|
3419
|
+
{
|
|
3420
|
+
"id": "CIBA-158",
|
|
3421
|
+
"section": "15",
|
|
3422
|
+
"requirement": "Support the described optional AD-to-CD single-use identifier carried in login_hint_token.",
|
|
3423
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.15",
|
|
3424
|
+
"normative_level": "definition_or_guidance",
|
|
3425
|
+
"normative_detail": "参考情報（optional scenario/example）",
|
|
3426
|
+
"conditional": true,
|
|
3427
|
+
"feature": "login_hint_token",
|
|
3428
|
+
"responsibility": "gem",
|
|
3429
|
+
"status": "code_reviewed",
|
|
3430
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3431
|
+
"code_symbols": [],
|
|
3432
|
+
"grouped_test_files": [],
|
|
3433
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3434
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3435
|
+
},
|
|
3436
|
+
{
|
|
3437
|
+
"id": "CIBA-159",
|
|
3438
|
+
"section": "15",
|
|
3439
|
+
"requirement": "Support the described optional discovery-service encrypted login_hint_token flow.",
|
|
3440
|
+
"source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html#rfc.section.15",
|
|
3441
|
+
"normative_level": "definition_or_guidance",
|
|
3442
|
+
"normative_detail": "参考情報（possible ecosystem scenario, no protocol conformance requirement）",
|
|
3443
|
+
"conditional": true,
|
|
3444
|
+
"feature": "login_hint_token",
|
|
3445
|
+
"responsibility": "gem",
|
|
3446
|
+
"status": "code_reviewed",
|
|
3447
|
+
"acceptance_gate": "Existing implementation and grouped tests; not a per-row conformance proof",
|
|
3448
|
+
"code_symbols": [],
|
|
3449
|
+
"grouped_test_files": [],
|
|
3450
|
+
"historical_status_not_current_evidence": "optional_excluded",
|
|
3451
|
+
"normative_scope_note": "The source detail governs compound rows; enum summarizes classification, not all duties in a section."
|
|
3452
|
+
},
|
|
3453
|
+
{
|
|
3454
|
+
"id": "OIDC-AUTH-TIME",
|
|
3455
|
+
"section": "OIDC Core 2",
|
|
3456
|
+
"requirement": "For accepted max_age or essential ID Token auth_time requests, preserve and enforce required authentication time at approval, issuance and refresh.",
|
|
3457
|
+
"source": "https://openid.net/specs/openid-connect-core-1_0.html#IDToken",
|
|
3458
|
+
"normative_level": "REQUIRED",
|
|
3459
|
+
"conditional": true,
|
|
3460
|
+
"feature": "claims_or_max_age_extension",
|
|
3461
|
+
"responsibility": "gem + app",
|
|
3462
|
+
"status": "local_regression_verified",
|
|
3463
|
+
"acceptance_gate": "Gem requires a non-null verified timestamp; application authenticates and enforces freshness. No invented timestamp.",
|
|
3464
|
+
"grouped_test_files": [
|
|
3465
|
+
"test/ciba_conformance_test.rb"
|
|
3466
|
+
]
|
|
3467
|
+
},
|
|
3468
|
+
{
|
|
3469
|
+
"id": "OIDC-ESSENTIAL-ACR",
|
|
3470
|
+
"section": "OIDC Core 5.5.1.1",
|
|
3471
|
+
"requirement": "For supported claims with essential ACR value/values, refuse approval and token issuance without matching achieved ACR; preserve requirements through refresh.",
|
|
3472
|
+
"source": "https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics",
|
|
3473
|
+
"normative_level": "MUST",
|
|
3474
|
+
"conditional": true,
|
|
3475
|
+
"feature": "claims_extension",
|
|
3476
|
+
"responsibility": "gem + app",
|
|
3477
|
+
"status": "local_regression_verified",
|
|
3478
|
+
"acceptance_gate": "Targeted negative regressions and final suite results recorded in delivery report; actual authentication and trusted attribute acquisition remain application-owned.",
|
|
3479
|
+
"grouped_test_files": [
|
|
3480
|
+
"test/ciba_claim_constraints_test.rb"
|
|
3481
|
+
]
|
|
3482
|
+
},
|
|
3483
|
+
{
|
|
3484
|
+
"id": "OIDC-REQUESTED-SUB",
|
|
3485
|
+
"section": "OIDC Core 3.1.2.2 / 5.5.1",
|
|
3486
|
+
"requirement": "Refuse positive tokens for a subject different from requested sub; compare actual public/pairwise RP subject. UserInfo retains issued subject.",
|
|
3487
|
+
"source": "https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation",
|
|
3488
|
+
"normative_level": "MUST",
|
|
3489
|
+
"conditional": true,
|
|
3490
|
+
"feature": "claims_extension",
|
|
3491
|
+
"responsibility": "gem + app",
|
|
3492
|
+
"status": "local_regression_verified",
|
|
3493
|
+
"acceptance_gate": "Targeted negative regressions and final suite results recorded in delivery report; actual authentication and trusted attribute acquisition remain application-owned.",
|
|
3494
|
+
"grouped_test_files": [
|
|
3495
|
+
"test/ciba_claim_constraints_test.rb"
|
|
3496
|
+
]
|
|
3497
|
+
},
|
|
3498
|
+
{
|
|
3499
|
+
"id": "OIDC-CLAIM-QUALIFIERS",
|
|
3500
|
+
"section": "OIDC Core 5.5.1",
|
|
3501
|
+
"requirement": "Validate qualifier shape and known value types; omit mismatching ordinary claims. Do not error solely for missing generic essential claims. Preserve filters per issuance and check final protocol fields.",
|
|
3502
|
+
"source": "https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests",
|
|
3503
|
+
"normative_level": "MUST",
|
|
3504
|
+
"conditional": true,
|
|
3505
|
+
"feature": "claims_extension",
|
|
3506
|
+
"responsibility": "gem + app",
|
|
3507
|
+
"status": "local_regression_verified",
|
|
3508
|
+
"acceptance_gate": "Targeted negative regressions and final suite results recorded in delivery report; actual authentication and trusted attribute acquisition remain application-owned.",
|
|
3509
|
+
"grouped_test_files": [
|
|
3510
|
+
"test/ciba_claim_constraints_test.rb"
|
|
3511
|
+
]
|
|
3512
|
+
},
|
|
3513
|
+
{
|
|
3514
|
+
"id": "OIDC-REFRESH-ORIGINAL-IDENTITY",
|
|
3515
|
+
"section": "OIDC Core 12.2",
|
|
3516
|
+
"requirement": "Refresh ID Tokens preserve the actual initial iss/sub/aud and disclosed auth_time, use new iat and omit nonce. Reject unverifiable legacy/corrupt contexts before hooks and mutation; preserve binding through rotation and pairwise sector changes.",
|
|
3517
|
+
"source": "https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse",
|
|
3518
|
+
"normative_level": "MUST plus nonce SHOULD NOT",
|
|
3519
|
+
"conditional": true,
|
|
3520
|
+
"feature": "experimental_refresh",
|
|
3521
|
+
"responsibility": "gem + deployment",
|
|
3522
|
+
"status": "local_regression_verified",
|
|
3523
|
+
"acceptance_gate": "Local SQLite regressions and installed-gem smoke; coordinated worker migration and official/PG/MySQL validation remain open.",
|
|
3524
|
+
"grouped_test_files": ["test/ciba_refresh_identity_test.rb", "test/ciba_pairwise_test.rb", "test/ciba_id_token_encryption_test.rb", "examples/extensions_smoke.rb"]
|
|
3525
|
+
}
|
|
3526
|
+
],
|
|
3527
|
+
"status_legend": {
|
|
3528
|
+
"code_reviewed": "Visible code boundary only; grouped tests listed, no exhaustive per-row proof",
|
|
3529
|
+
"application_contract": "Application/deployment obligation not tested in a real service",
|
|
3530
|
+
"client_duty": "RP role outside this OP extension",
|
|
3531
|
+
"experimental_unverified": "Feature outside supported release; conditional requirements require separate evaluation",
|
|
3532
|
+
"not_applicable": "Unsupported mode or omitted optional output",
|
|
3533
|
+
"optional_not_implemented": "Permitted capability not provided",
|
|
3534
|
+
"regression_pending": "Implementation has targeted tests; results recorded separately",
|
|
3535
|
+
"local_regression_verified": "Specific local regressions executed; not exhaustive conformance or deployment proof"
|
|
3536
|
+
}
|
|
3537
|
+
}
|