Specification hierarchy: * *
* OAuth 2.0 (RFC 6749) * └─ OIDC Core 1.0 * └─ FAPI 1.0 Baseline (Part 1) → FapiBaselineVerifier * └─ FAPI 1.0 Advanced (Part 2) ← this class ** *
FAPI 1.0 Advanced Section 5.2.2 states: "In addition to the provisions in Section 5.2.2 of * [FAPI1-BASE], the authorization server SHALL ..." * *
This means Advanced inherits ALL Baseline requirements, with some replacements. This class * does NOT delegate to {@link FapiBaselineVerifier} to allow explicit control over which Baseline * requirements are inherited versus replaced. Each requirement is explicitly listed in {@link * #verify(OAuthRequestContext)} with comments indicating its origin. * *
Inherited from Baseline (unchanged): * *
Replaced from Baseline: * *
Advanced-specific: * *
This method is invoked during authorization request verification. Requests arrive via two * paths: * *
Accepted request patterns: * *
Request Objects with alg:none (unsigned) are rejected. However, for PAR-based requests the * unsigned check is skipped because the JoseContext is not preserved after PAR storage (already * validated at the PAR endpoint). * * @see * FAPI 1.0 Advanced Final Section 5.2.2 * @see RFC 9126 Section 2 */ void throwExceptionIfNotRequestParameterPattern(OAuthRequestContext context) { if (!context.isRequestParameterPattern() && !context.isPushedRequest()) { throw new OAuthRedirectableBadRequestException( "invalid_request", "When FAPI Advance profile, shall require a JWS signed JWT request object passed by value with the request parameter or by reference with the request_uri parameter", context); } if (!context.isPushedRequest() && context.isUnsignedRequestObject()) { throw new OAuthRedirectableBadRequestException( "invalid_request_object", "When FAPI Advance profile, request object must be signed with a JWS algorithm, alg:none is not allowed", context); } } /** * shall require the response_type value code id_token, or the response_type value code in * conjunction with the response_mode value jwt; */ void throwExceptionIfInvalidResponseTypeAndResponseMode(OAuthRequestContext context) { if (context.responseType().isCodeIdToken()) { return; } if (context.responseType().isCode() && context.responseMode().isJwt()) { return; } throw new OAuthRedirectableBadRequestException( "invalid_request", "When FAPI Advance profile, shall require the response_type value code id_token, or the response_type value code in conjunction with the response_mode value jwt", context); } /** * shall only issue sender-constrained access tokens; * *
shall support MTLS as mechanism for constraining the legitimate senders of access tokens;
*/
void throwIfNotSenderConstrainedAccessToken(OAuthRequestContext context) {
AuthorizationServerConfiguration authorizationServerConfiguration =
context.serverConfiguration();
ClientConfiguration clientConfiguration = context.clientConfiguration();
if (!authorizationServerConfiguration.isTlsClientCertificateBoundAccessTokens()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile, shall only issue sender-constrained access tokens, but server tls_client_certificate_bound_access_tokens is false",
context);
}
if (!clientConfiguration.isTlsClientCertificateBoundAccessTokens()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile, shall only issue sender-constrained access tokens, but client tls_client_certificate_bound_access_tokens is false",
context);
}
}
/**
* shall require the request object to contain an exp claim that has a lifetime of no longer than
* 60 minutes after the nbf claim;
*/
void throwExceptionIfNotContainExpAndNbfAndExp60minutesLongerThanNbf(
OAuthRequestContext context) {
JoseContext joseContext = context.joseContext();
JsonWebTokenClaims claims = joseContext.claims();
if (!claims.hasExp()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an exp claim",
context);
}
if (!claims.hasNbf()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an nbf claim",
context);
}
Date exp = claims.getExp();
Date nbf = claims.getNbf();
if (exp.getTime() - nbf.getTime() > SIXTY_MINUTES_IN_MILLIS) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim",
context);
}
}
/**
* FAPI 1.0 Advanced Section 5.2.2-15: shall require the aud claim in the request object to be, or
* to be an array containing, the OP's Issuer Identifier URL.
*/
void throwExceptionIfNotContainsAud(OAuthRequestContext context) {
JoseContext joseContext = context.joseContext();
JsonWebTokenClaims claims = joseContext.claims();
if (!claims.hasAud()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an aud claim",
context);
}
List "shall require PAR requests, if supported, to use PKCE (RFC7636) with S256 as the code
* challenge method"
*
* This replaces the Baseline 5.2.2-7 PKCE requirement. In FAPI Advanced, PKCE is only required
* when PAR is used. For non-PAR requests (e.g., Hybrid Flow with code id_token), PKCE is not
* required because the ID Token's c_hash provides authorization code integrity protection.
*/
void throwExceptionIfNotS256CodeChallengeMethodForPAR(OAuthRequestContext context) {
AuthorizationRequest authorizationRequest = context.authorizationRequest();
if (!authorizationRequest.hasCodeChallenge()
|| !authorizationRequest.hasCodeChallengeMethod()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile with PAR, shall require PKCE (RFC7636) with S256 as the code challenge method",
context);
}
if (!authorizationRequest.codeChallengeMethod().isS256()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile with PAR, shall require S256 as the code challenge method",
context);
}
}
/**
* Inherited from FAPI 1.0 Baseline 5.2.2-20: shall require redirect URIs to use the https scheme.
*/
void throwExceptionIfNotHttpsRedirectUri(OAuthRequestContext context) {
RedirectUri redirectUri = context.redirectUri();
if (!redirectUri.isHttps()) {
throw new OAuthBadRequestException(
"invalid_request",
String.format(
"When FAPI Advance profile, shall require redirect URIs to use the https scheme (%s)",
context.redirectUri().value()),
context.tenant());
}
}
/**
* Inherited from FAPI 1.0 Baseline 5.2.2.2: If the client requests the openid scope, the
* authorization server shall require the nonce parameter defined in Section 3.1.2.1 of OIDC in
* the authentication request.
*/
void throwExceptionIfHasOpenidScopeAndNotContainsNonce(OAuthRequestContext context) {
if (!context.hasOpenidScope()) {
return;
}
if (!context.authorizationRequest().hasNonce()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile, shall require the nonce parameter defined in Section 3.1.2.1 of OIDC in the authentication request (inherited from FAPI Baseline 5.2.2.2).",
context);
}
}
/**
* Inherited from FAPI 1.0 Baseline 5.2.2.3: If the client does not request the openid scope, the
* authorization server shall require the state parameter defined in Section 4.1.1 of RFC 6749.
*/
void throwExceptionIfNotHasOpenidScopeAndNotContainsState(OAuthRequestContext context) {
if (context.hasOpenidScope()) {
return;
}
if (!context.authorizationRequest().hasState()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request",
"When FAPI Advance profile, shall require the state parameter defined in Section 4.1.1 of RFC 6749 (inherited from FAPI Baseline 5.2.2.3).",
context);
}
}
/** 5.2.2-16: shall not support public clients. */
void throwExceptionIfPublicClient(OAuthRequestContext context) {
ClientAuthenticationType clientAuthenticationType = context.clientAuthenticationType();
if (clientAuthenticationType.isNone()) {
throw new OAuthRedirectableBadRequestException(
"unauthorized_client",
"When FAPI Advance profile, shall not support public clients",
context);
}
}
/**
* FAPI 1.0 Advanced Section 8.6: Algorithm restrictions for JWS.
*
* shall use PS256 or ES256 algorithms; shall not use algorithms that use RSASSA-PKCS1-v1_5
* (e.g. RS256); shall not use none.
*/
void throwExceptionIfInvalidSigningAlgorithm(OAuthRequestContext context) {
JoseContext joseContext = context.joseContext();
if (!joseContext.hasJsonWebSignature()) {
return;
}
String algorithm = joseContext.jsonWebSignature().algorithm();
if (!"PS256".equals(algorithm) && !"ES256".equals(algorithm)) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
String.format(
"When FAPI Advance profile, request object signing algorithm must be PS256 or ES256 (Section 8.6). Current algorithm: %s",
algorithm),
context);
}
}
/**
* shall require the request object to contain an nbf claim that is no longer than 60 minutes in
* the past; and
*/
void throwExceptionIfNotContainNbfAnd60minutesLongerThan(OAuthRequestContext context) {
JoseContext joseContext = context.joseContext();
JsonWebTokenClaims claims = joseContext.claims();
if (!claims.hasNbf()) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an nbf claim",
context);
}
Date now = new Date();
Date nbf = claims.getNbf();
if (now.getTime() - nbf.getTime() > SIXTY_MINUTES_IN_MILLIS) {
throw new OAuthRedirectableBadRequestException(
"invalid_request_object",
"When FAPI Advance profile, shall require the request object to contain an nbf claim that is no longer than 60 minutes in the past",
context);
}
}
}