rodauth-oauth 1.1.0 → 1.3.0

data/lib/rodauth/features/oauth_pushed_authorization_request.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_pushed_authorization_request, :OauthJwtPushedAuthorizationRequest) do
+    depends :oauth_authorize_base
+
+    auth_value_method :oauth_require_pushed_authorization_requests, false
+    auth_value_method :oauth_applications_require_pushed_authorization_requests_column, :require_pushed_authorization_requests
+    auth_value_method :oauth_pushed_authorization_request_expires_in, 90 # 90 seconds
+    auth_value_method :oauth_require_pushed_authorization_request_iss_request_object, true
+
+    auth_value_method :oauth_pushed_authorization_requests_table, :oauth_pushed_requests
+
+    %i[
+      oauth_application_id params code expires_in
+    ].each do |column|
+      auth_value_method :"oauth_pushed_authorization_requests_#{column}_column", column
+    end
+
+    # /par
+    auth_server_route(:par) do |r|
+      require_oauth_application
+      before_par_route
+
+      r.post do
+        validate_par_params
+
+        ds = db[oauth_pushed_authorization_requests_table]
+
+        code = oauth_unique_id_generator
+        push_request_params = {
+          oauth_pushed_authorization_requests_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+          oauth_pushed_authorization_requests_code_column => code,
+          oauth_pushed_authorization_requests_params_column => URI.encode_www_form(request.params),
+          oauth_pushed_authorization_requests_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP,
+                                                                                   seconds: oauth_pushed_authorization_request_expires_in)
+        }
+
+        rescue_from_uniqueness_error do
+          ds.insert(push_request_params)
+        end
+
+        json_response_success(
+          "request_uri" => "urn:ietf:params:oauth:request_uri:#{code}",
+          "expires_in" => oauth_pushed_authorization_request_expires_in
+        )
+      end
+    end
+
+    def check_csrf?
+      case request.path
+      when par_path
+        false
+      else
+        super
+      end
+    end
+
+    private
+
+    def validate_par_params
+      # https://datatracker.ietf.org/doc/html/rfc9126#section-2.1
+      # The request_uri authorization request parameter is one exception, and it MUST NOT be provided.
+      redirect_response_error("invalid_request") if param_or_nil("request_uri")
+
+      if (request_object = param_or_nil("request")) && features.include?(:oauth_jwt_secured_authorization_request)
+        claims = decode_request_object(request_object)
+
+        # https://datatracker.ietf.org/doc/html/rfc9126#section-3-5.3
+        # reject the request if the authenticated client_id does not match the client_id claim in the Request Object
+        if (client_id = claims["client_id"]) && (client_id != oauth_application[oauth_applications_client_id_column])
+          redirect_response_error("invalid_request_object")
+        end
+
+        # requiring the iss claim to match the client_id is at the discretion of the authorization server
+        if oauth_require_pushed_authorization_request_iss_request_object &&
+           (iss = claims.delete("iss")) &&
+           iss != oauth_application[oauth_applications_client_id_column]
+          redirect_response_error("invalid_request_object")
+        end
+
+        if (aud = claims.delete("aud")) && !verify_aud(aud, oauth_jwt_issuer)
+          redirect_response_error("invalid_request_object")
+        end
+
+        claims.delete("exp")
+        request.params.delete("request")
+
+        claims.each do |k, v|
+          request.params[k.to_s] = v
+        end
+      end
+
+      validate_authorize_params
+    end
+
+    def validate_authorize_params
+      return super unless request.get? && request.path == authorize_path
+
+      if (request_uri = param_or_nil("request_uri"))
+        code = request_uri.delete_prefix("urn:ietf:params:oauth:request_uri:")
+
+        table = oauth_pushed_authorization_requests_table
+        ds = db[table]
+
+        pushed_request = ds.where(
+          oauth_pushed_authorization_requests_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+          oauth_pushed_authorization_requests_code_column => code
+        ).where(
+          Sequel.expr(Sequel[table][oauth_pushed_authorization_requests_expires_in_column]) >= Sequel::CURRENT_TIMESTAMP
+        ).first
+
+        redirect_response_error("invalid_request") unless pushed_request
+
+        URI.decode_www_form(pushed_request[oauth_pushed_authorization_requests_params_column]).each do |k, v|
+          request.params[k.to_s] = v
+        end
+
+      elsif oauth_require_pushed_authorization_requests ||
+            (oauth_application && oauth_application[oauth_applications_require_pushed_authorization_requests_column])
+        redirect_authorize_error("request_uri")
+      end
+      super
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:require_pushed_authorization_requests] = oauth_require_pushed_authorization_requests
+        data[:pushed_authorization_request_endpoint] = par_url
+      end
+    end
+  end
+end

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "ipaddr"
+require "uri"
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_tls_client_auth, :OauthTlsClientAuth) do
+    depends :oauth_jwt_base
+
+    auth_value_method :oauth_tls_client_certificate_bound_access_tokens, false
+
+    %i[
+      tls_client_auth_subject_dn tls_client_auth_san_dns
+      tls_client_auth_san_uri tls_client_auth_san_ip
+      tls_client_auth_san_email tls_client_certificate_bound_access_tokens
+    ].each do |column|
+      auth_value_method :"oauth_applications_#{column}_column", column
+    end
+
+    auth_value_method :oauth_grants_certificate_thumbprint_column, :certificate_thumbprint
+
+    def oauth_token_endpoint_auth_methods_supported
+      super | %w[tls_client_auth self_signed_tls_client_auth]
+    end
+
+    private
+
+    def validate_token_params
+      # For all requests to the authorization server utilizing mutual-TLS client authentication,
+      # the client MUST include the client_id parameter
+      redirect_response_error("invalid_request") if client_certificate && !param_or_nil("client_id")
+
+      super
+    end
+
+    def require_oauth_application
+      return super unless client_certificate
+
+      authorization_required unless oauth_application
+
+      if supports_auth_method?(oauth_application, "tls_client_auth")
+        # It relies on a validated certificate chain [RFC5280]
+
+        ssl_verify = request.env["SSL_CLIENT_VERIFY"] || request.env["HTTP_SSL_CLIENT_VERIFY"] || request.env["HTTP_X_SSL_CLIENT_VERIFY"]
+
+        authorization_required unless ssl_verify == "SUCCESS"
+
+        # and a single subject distinguished name (DN) or a single subject alternative name (SAN) to
+        # authenticate the client. Only one subject name value of any type is used for each client.
+
+        name_matches = if oauth_application[:tls_client_auth_subject_dn]
+                         distinguished_name_match?(client_certificate.subject, oauth_application[:tls_client_auth_subject_dn])
+                       elsif (dns = oauth_application[:tls_client_auth_san_dns])
+                         client_certificate_sans.any? { |san| san.tag == 2 && OpenSSL::SSL.verify_hostname(dns, san.value) }
+                       elsif (uri = oauth_application[:tls_client_auth_san_uri])
+                         uri = URI(uri)
+                         client_certificate_sans.any? { |san| san.tag == 6 && URI(san.value) == uri }
+                       elsif (ip = oauth_application[:tls_client_auth_san_ip])
+                         ip = IPAddr.new(ip).hton
+                         client_certificate_sans.any? { |san| san.tag == 7 && san.value == ip }
+                       elsif (email = oauth_application[:tls_client_auth_san_email])
+                         client_certificate_sans.any? { |san| san.tag == 1 && san.value == email }
+                       else
+                         false
+                       end
+        authorization_required unless name_matches
+
+        oauth_application
+      elsif supports_auth_method?(oauth_application, "self_signed_tls_client_auth")
+        jwks = oauth_application_jwks(oauth_application)
+
+        thumbprint = jwk_thumbprint(key_to_jwk(client_certificate.public_key))
+
+        # The client is successfully authenticated if the certificate that it presented during the handshake
+        # matches one of the certificates configured or registered for that particular client.
+        authorization_required unless jwks.any? { |jwk| Array(jwk[:x5c]).first == thumbprint }
+
+        oauth_application
+      else
+        super
+      end
+    rescue URI::InvalidURIError, IPAddr::InvalidAddressError
+      authorization_required
+    end
+
+    def store_token(grant_params, update_params = {})
+      return super unless client_certificate && (
+        oauth_tls_client_certificate_bound_access_tokens ||
+        oauth_application[oauth_applications_tls_client_certificate_bound_access_tokens_column]
+      )
+
+      update_params[oauth_grants_certificate_thumbprint_column] = jwk_thumbprint(key_to_jwk(client_certificate.public_key))
+      super
+    end
+
+    def jwt_claims(oauth_grant)
+      claims = super
+
+      return claims unless oauth_grant[oauth_grants_certificate_thumbprint_column]
+
+      claims[:cnf] = {
+        "x5t#S256" => oauth_grant[oauth_grants_certificate_thumbprint_column]
+      }
+
+      claims
+    end
+
+    def json_token_introspect_payload(grant_or_claims)
+      claims = super
+
+      return claims unless grant_or_claims && grant_or_claims[oauth_grants_certificate_thumbprint_column]
+
+      claims[:cnf] = {
+        "x5t#S256" => grant_or_claims[oauth_grants_certificate_thumbprint_column]
+      }
+
+      claims
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:tls_client_certificate_bound_access_tokens] = oauth_tls_client_certificate_bound_access_tokens
+      end
+    end
+
+    def client_certificate
+      return @client_certificate if defined?(@client_certificate)
+
+      unless (pem_cert = request.env["SSL_CLIENT_CERT"] || request.env["HTTP_SSL_CLIENT_CERT"] || request.env["HTTP_X_SSL_CLIENT_CERT"])
+        return
+      end
+
+      return if pem_cert.empty?
+
+      @certificate = OpenSSL::X509::Certificate.new(pem_cert)
+    end
+
+    def client_certificate_sans
+      return @client_certificate_sans if defined?(@client_certificate_sans)
+
+      @client_certificate_sans = begin
+        return [] unless client_certificate
+
+        san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" }
+
+        return [] unless san
+
+        ostr = OpenSSL::ASN1.decode(san.to_der).value.last
+
+        sans = OpenSSL::ASN1.decode(ostr.value)
+
+        return [] unless sans
+
+        sans.value
+      end
+    end
+
+    def distinguished_name_match?(sub1, sub2)
+      sub1 = OpenSSL::X509::Name.parse(sub1) if sub1.is_a?(String)
+      sub2 = OpenSSL::X509::Name.parse(sub2) if sub2.is_a?(String)
+      # OpenSSL::X509::Name#cp calls X509_NAME_cmp via openssl.
+      # https://www.openssl.org/docs/manmaster/man3/X509_NAME_cmp.html
+      # This procedure adheres to the matching rules for Distinguished Names (DN) given in
+      # RFC 4517 section 4.2.15 and RFC 5280 section 7.1.
+      sub1.cmp(sub2).zero?
+    end
+  end
+end

data/lib/rodauth/features/oidc.rb

@@ -63,12 +63,12 @@ module Rodauth
       id_token_signing_alg_values_supported
     ].freeze
 
-    depends :account_expiration, :oauth_jwt, :oauth_jwt_jwks, :oauth_authorization_code_grant
+    depends :account_expiration, :oauth_jwt, :oauth_jwt_jwks, :oauth_authorization_code_grant, :oauth_implicit_grant
 
     auth_value_method :oauth_application_scopes, %w[openid]
 
     %i[
-      subject_type application_type sector_identifier_uri
+      subject_type application_type sector_identifier_uri initiate_login_uri
       id_token_signed_response_alg id_token_encrypted_response_alg id_token_encrypted_response_enc
       userinfo_signed_response_alg userinfo_encrypted_response_alg userinfo_encrypted_response_enc
     ].each do |column|
@@ -89,9 +89,16 @@ module Rodauth
     auth_value_method :oauth_prompt_login_interval, 5 * 60 * 60 # 5 minutes
 
     auth_value_methods(
+      :userinfo_signing_alg_values_supported,
+      :userinfo_encryption_alg_values_supported,
+      :userinfo_encryption_enc_values_supported,
+      :request_object_signing_alg_values_supported,
+      :request_object_encryption_alg_values_supported,
+      :request_object_encryption_enc_values_supported,
       :oauth_acr_values_supported,
       :get_oidc_account_last_login_at,
       :oidc_authorize_on_prompt_none?,
+      :fill_with_account_claims,
       :get_oidc_param,
       :get_additional_param,
       :require_acr_value_phr,
@@ -112,7 +119,7 @@ module Rodauth
 
           throw_json_response_error(oauth_authorization_required_error_status, "invalid_token") unless oauth_scopes.include?("openid")
 
-          account = db[accounts_table].where(account_id_column => claims["sub"]).first
+          account = account_ds(claims["sub"]).first
 
           throw_json_response_error(oauth_authorization_required_error_status, "invalid_token") unless account
 
@@ -126,7 +133,7 @@ module Rodauth
 
           oauth_grant = valid_oauth_grant_ds(
             oauth_grants_oauth_application_id_column => @oauth_application[oauth_applications_id_column],
-            oauth_grants_account_id_column => account[account_id_column]
+            **resource_owner_params_from_jwt_claims(claims)
           ).first
 
           claims_locales = oauth_grant[oauth_grants_claims_locales_column] if oauth_grant
@@ -233,6 +240,30 @@ module Rodauth
       end
     end
 
+    def userinfo_signing_alg_values_supported
+      oauth_jwt_jws_algorithms_supported
+    end
+
+    def userinfo_encryption_alg_values_supported
+      oauth_jwt_jwe_algorithms_supported
+    end
+
+    def userinfo_encryption_enc_values_supported
+      oauth_jwt_jwe_encryption_methods_supported
+    end
+
+    def request_object_signing_alg_values_supported
+      oauth_jwt_jws_algorithms_supported
+    end
+
+    def request_object_encryption_alg_values_supported
+      oauth_jwt_jwe_algorithms_supported
+    end
+
+    def request_object_encryption_enc_values_supported
+      oauth_jwt_jwe_encryption_methods_supported
+    end
+
     def oauth_acr_values_supported
       acr_values = []
       acr_values << "phrh" if features.include?(:webauthn_login)
@@ -274,29 +305,33 @@ module Rodauth
 
       sc = scopes
 
-      if sc && sc.include?("offline_access")
-
+      # MUST ensure that the prompt parameter contains consent
+      # MUST ignore the offline_access request unless the Client
+      # is using a response_type value that would result in an
+      # Authorization Code
+      if sc && sc.include?("offline_access") && !(param_or_nil("prompt") == "consent" && (
+                (response_type = param_or_nil("response_type")) && response_type.split(" ").include?("code")
+              ))
         sc.delete("offline_access")
 
-        # MUST ensure that the prompt parameter contains consent
-        # MUST ignore the offline_access request unless the Client
-        # is using a response_type value that would result in an
-        # Authorization Code
-        if param_or_nil("prompt") == "consent" && (
-          (response_type = param_or_nil("response_type")) && response_type.split(" ").include?("code")
-        )
-          request.params["access_type"] = "offline"
-        end
-
         request.params["scope"] = sc.join(" ")
       end
 
       super
 
-      return unless (response_type = param_or_nil("response_type"))
-      return unless response_type.include?("id_token")
+      response_type = param_or_nil("response_type")
+
+      is_id_token_response_type = response_type.include?("id_token")
+
+      redirect_response_error("invalid_request") if is_id_token_response_type && !param_or_nil("nonce")
+
+      return unless is_id_token_response_type || response_type == "code token"
+
+      response_mode = param_or_nil("response_mode")
+
+      # id_token: The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used.
 
-      redirect_response_error("invalid_request") unless param_or_nil("nonce")
+      redirect_response_error("invalid_request") unless response_mode.nil? || response_mode == "fragment"
     end
 
     def require_authorizable_account
@@ -333,8 +368,9 @@ module Rodauth
 
         identifier_uri = URI(identifier_uri).host
 
-        account_id = oauth_grant[oauth_grants_account_id_column]
-        Digest::SHA256.hexdigest("#{identifier_uri}#{account_id}#{oauth_jwt_subject_secret}")
+        account_ids = oauth_grant.values_at(oauth_grants_resource_owner_columns)
+        values = [identifier_uri, *account_ids, oauth_jwt_subject_secret]
+        Digest::SHA256.hexdigest(values.join)
       else
         raise StandardError, "unexpected subject (#{subject_type})"
       end
@@ -434,8 +470,8 @@ module Rodauth
     end
 
     def create_oauth_grant_with_token(create_params = {})
+      create_params.merge!(resource_owner_params)
       create_params[oauth_grants_type_column] = "hybrid"
-      create_params[oauth_grants_account_id_column] = account_id
       create_params[oauth_grants_expires_in_column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_access_token_expires_in)
       authorization_code = create_oauth_grant(create_params)
       access_token = if oauth_jwt_access_tokens
@@ -462,24 +498,7 @@ module Rodauth
       signing_algorithm = oauth_application[oauth_applications_id_token_signed_response_alg_column] ||
                           oauth_jwt_keys.keys.first
 
-      id_token_claims = jwt_claims(oauth_grant)
-
-      id_token_claims[:nonce] = oauth_grant[oauth_grants_nonce_column] if oauth_grant[oauth_grants_nonce_column]
-
-      id_token_claims[:acr] = oauth_grant[oauth_grants_acr_column] if oauth_grant[oauth_grants_acr_column]
-
-      # Time when the End-User authentication occurred.
-      id_token_claims[:auth_time] = get_oidc_account_last_login_at(oauth_grant[oauth_grants_account_id_column]).to_i
-
-      # Access Token hash value.
-      if (access_token = oauth_grant[oauth_grants_token_column])
-        id_token_claims[:at_hash] = id_token_hash(access_token, signing_algorithm)
-      end
-
-      # code hash value.
-      if (code = oauth_grant[oauth_grants_code_column])
-        id_token_claims[:c_hash] = id_token_hash(code, signing_algorithm)
-      end
+      id_claims = id_token_claims(oauth_grant, signing_algorithm)
 
       account = db[accounts_table].where(account_id_column => oauth_grant[oauth_grants_account_id_column]).first
 
@@ -499,7 +518,7 @@ module Rodauth
 
       # 5.4 - However, when no Access Token is issued (which is the case for the response_type value id_token),
       # the resulting Claims are returned in the ID Token.
-      fill_with_account_claims(id_token_claims, account, oauth_scopes, param_or_nil("claims_locales")) if include_claims
+      fill_with_account_claims(id_claims, account, oauth_scopes, param_or_nil("claims_locales")) if include_claims
 
       params = {
         jwks: oauth_application_jwks(oauth_application),
@@ -508,7 +527,30 @@ module Rodauth
         encryption_method: oauth_application[oauth_applications_id_token_encrypted_response_enc_column]
       }.compact
 
-      oauth_grant[:id_token] = jwt_encode(id_token_claims, **params)
+      oauth_grant[:id_token] = jwt_encode(id_claims, **params)
+    end
+
+    def id_token_claims(oauth_grant, signing_algorithm)
+      claims = jwt_claims(oauth_grant)
+
+      claims[:nonce] = oauth_grant[oauth_grants_nonce_column] if oauth_grant[oauth_grants_nonce_column]
+
+      claims[:acr] = oauth_grant[oauth_grants_acr_column] if oauth_grant[oauth_grants_acr_column]
+
+      # Time when the End-User authentication occurred.
+      claims[:auth_time] = get_oidc_account_last_login_at(oauth_grant[oauth_grants_account_id_column]).to_i
+
+      # Access Token hash value.
+      if (access_token = oauth_grant[oauth_grants_token_column])
+        claims[:at_hash] = id_token_hash(access_token, signing_algorithm)
+      end
+
+      # code hash value.
+      if (code = oauth_grant[oauth_grants_code_column])
+        claims[:c_hash] = id_token_hash(code, signing_algorithm)
+      end
+
+      claims
     end
 
     # aka fill_with_standard_claims
@@ -587,14 +629,14 @@ module Rodauth
           additional_info = additional_claims_info[param] || EMPTY_HASH
           value = additional_info["value"] || meth[account, param]
           value = nil if additional_info["values"] && additional_info["values"].include?(value)
-          cl[param] = value if value
+          cl[param] = value unless value.nil?
         end
       elsif claims_locales.nil?
         lambda do |account, param, cl = claims|
           additional_info = additional_claims_info[param] || EMPTY_HASH
           value = additional_info["value"] || meth[account, param, nil]
           value = nil if additional_info["values"] && additional_info["values"].include?(value)
-          cl[param] = value if value
+          cl[param] = value unless value.nil?
         end
       else
         lambda do |account, param, cl = claims|
@@ -626,10 +668,9 @@ module Rodauth
 
     def check_valid_response_type?
       case param_or_nil("response_type")
-      when "none", "id_token", "code id_token" # multiple
+      when "none", "id_token", "code id_token", # multiple
+           "code token", "id_token token", "code id_token token"
         true
-      when "code token", "id_token token", "code id_token token"
-        supports_token_response_type?
       else
         super
       end
@@ -641,10 +682,6 @@ module Rodauth
       param("response_type") == "none"
     end
 
-    def supports_token_response_type?
-      features.include?(:oauth_implicit_grant)
-    end
-
     def do_authorize(response_params = {}, response_mode = param_or_nil("response_mode"))
       response_type = param("response_type")
       case response_type
@@ -653,8 +690,6 @@ module Rodauth
         generate_id_token(grant_params, true)
         response_params.replace("id_token" => grant_params[:id_token])
       when "code token"
-        redirect_response_error("invalid_request") unless supports_token_response_type?
-
         response_params.replace(create_oauth_grant_with_token)
       when "code id_token"
         params = _do_authorize_code
@@ -665,16 +700,12 @@ module Rodauth
           "code" => params["code"]
         )
       when "id_token token"
-        redirect_response_error("invalid_request") unless supports_token_response_type?
-
         grant_params = oidc_grant_params.merge(oauth_grants_type_column => "hybrid")
         oauth_grant = _do_authorize_token(grant_params)
         generate_id_token(oauth_grant)
 
         response_params.replace(json_access_token_payload(oauth_grant))
       when "code id_token token"
-        redirect_response_error("invalid_request") unless supports_token_response_type?
-
         params = create_oauth_grant_with_token
         oauth_grant = valid_oauth_grant_ds.where(oauth_grants_code_column => params["code"]).first
         oauth_grant[oauth_grants_token_column] = params["access_token"]
@@ -691,9 +722,10 @@ module Rodauth
 
     def oidc_grant_params
       grant_params = {
-        oauth_grants_account_id_column => account_id,
+        **resource_owner_params,
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
-        oauth_grants_scopes_column => scopes.join(oauth_scope_separator)
+        oauth_grants_scopes_column => scopes.join(oauth_scope_separator),
+        oauth_grants_redirect_uri_column => param_or_nil("redirect_uri")
       }
       if (nonce = param_or_nil("nonce"))
         grant_params[oauth_grants_nonce_column] = nonce
@@ -708,6 +740,12 @@ module Rodauth
       grant_params
     end
 
+    def generate_token(grant_params = {}, should_generate_refresh_token = true)
+      scopes = grant_params[oauth_grants_scopes_column].split(oauth_scope_separator)
+
+      super(grant_params, scopes.include?("offline_access") && should_generate_refresh_token)
+    end
+
     def authorize_response(params, mode)
       redirect_url = URI.parse(redirect_uri)
       redirect(redirect_url.to_s) if mode == "none"

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -10,7 +10,7 @@ module Rodauth
 
     private
 
-    def validate_client_registration_params
+    def validate_client_registration_params(*)
       super
 
       if (value = @oauth_application_params[oauth_applications_application_type_column])
@@ -43,7 +43,11 @@ module Rodauth
         end
       end
 
-      if (value = @oauth_application_params[oauth_applications_sector_identifier_uri_column])
+      if (value = @oauth_application_params[oauth_applications_sector_identifier_uri_column]) && !check_valid_uri?(value)
+        register_throw_json_response_error("invalid_redirect_uri", register_invalid_uri_message(value))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_initiate_login_uri_column])
         uri = URI(value)
 
         unless uri.scheme == "https" || uri.host == "localhost"
@@ -170,6 +174,44 @@ module Rodauth
         register_throw_json_response_error("invalid_client_metadata",
                                            register_invalid_client_metadata_message("userinfo_encrypted_response_enc", value))
       end
+
+      if features.include?(:oauth_jwt_secured_authorization_response_mode)
+        if defined?(oauth_applications_authorization_signed_response_alg_column) &&
+           (value = @oauth_application_params[oauth_applications_authorization_signed_response_alg_column]) &&
+           (!oauth_jwt_jws_algorithms_supported.include?(value) || value == "none")
+          register_throw_json_response_error("invalid_client_metadata",
+                                             register_invalid_client_metadata_message("authorization_signed_response_alg", value))
+        end
+
+        if defined?(oauth_applications_authorization_encrypted_response_alg_column) &&
+           (value = @oauth_application_params[oauth_applications_authorization_encrypted_response_alg_column]) &&
+           !oauth_jwt_jwe_algorithms_supported.include?(value)
+          register_throw_json_response_error("invalid_client_metadata",
+                                             register_invalid_client_metadata_message("authorization_encrypted_response_alg", value))
+        end
+
+        if defined?(oauth_applications_authorization_encrypted_response_enc_column)
+          if (value = @oauth_application_params[oauth_applications_authorization_encrypted_response_enc_column])
+
+            unless @oauth_application_params[oauth_applications_authorization_encrypted_response_alg_column]
+              # When authorization_encrypted_response_enc is included, authorization_encrypted_response_alg MUST also be provided.
+              register_throw_json_response_error("invalid_client_metadata",
+                                                 register_invalid_client_metadata_message("authorization_encrypted_response_alg", value))
+
+            end
+
+            unless oauth_jwt_jwe_encryption_methods_supported.include?(value)
+              register_throw_json_response_error("invalid_client_metadata",
+                                                 register_invalid_client_metadata_message("authorization_encrypted_response_enc", value))
+            end
+          elsif @oauth_application_params[oauth_applications_authorization_encrypted_response_alg_column]
+            # If authorization_encrypted_response_alg is specified, the default for this value is A128CBC-HS256.
+            @oauth_application_params[oauth_applications_authorization_encrypted_response_enc_column] = "A128CBC-HS256"
+          end
+        end
+      end
+
+      @oauth_application_params
     end
 
     def validate_client_registration_response_type(response_type, grant_types)
@@ -219,5 +261,13 @@ module Rodauth
     def register_invalid_application_type_message(application_type)
       "The application type '#{application_type}' is not allowed."
     end
+
+    def initialize_register_params(create_params, return_params)
+      super
+      registration_access_token = oauth_unique_id_generator
+      create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
+      return_params["registration_access_token"] = registration_access_token
+      return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
+    end
   end
 end