Per RFC 9126 Section 2.1, the PAR endpoint applies the same client authentication rules as * the token endpoint. Per RFC 7521 Section 4.2, client_id is resolved with fallback: explicit * parameter → Basic Auth → client_assertion JWT iss claim. */ public OAuthPushedRequestContext handlePushedRequest(OAuthPushedRequest pushedRequest) { OAuthRequestParameters requestParameters = pushedRequest.toOAuthRequestParameters(); Tenant tenant = pushedRequest.tenant(); RequestedClientId clientId = pushedRequest.clientId(); log.trace( "OAuth pushed request started: client={}, response_type={}", clientId.value(), requestParameters.responseType().value()); OAuthPushedRequestValidator validator = new OAuthPushedRequestValidator(tenant, pushedRequest); validator.validate(); new DPoPHeaderValidator(pushedRequest.dpopProofHeaders()).validate(); AuthorizationServerConfiguration authorizationServerConfiguration = authorizationServerConfigurationQueryRepository.get(tenant); ClientConfiguration clientConfiguration = clientConfigurationQueryRepository.get(tenant, clientId); // RFC 9449 §10.1: PAR + DPoP integration // If a DPoP proof is presented at the PAR endpoint, verify it and bind the resulting JWK // thumbprint to the pushed authorization request as dpop_jkt. OAuthRequestParameters effectiveParameters = applyDPoPProofToParameters( pushedRequest, requestParameters, tenant, authorizationServerConfiguration); OAuthRequestPattern oAuthRequestPattern = effectiveParameters.analyzePattern(); OAuthRequestContextCreator oAuthRequestContextCreator = oAuthRequestContextCreators.get(oAuthRequestPattern); OAuthRequestContext context = oAuthRequestContextCreator.create( tenant, effectiveParameters, authorizationServerConfiguration, clientConfiguration, true); OAuthPushedRequestContext oAuthPushedRequestContext = new OAuthPushedRequestContext( context, pushedRequest.clientSecretBasic(), pushedRequest.toClientCert(), pushedRequest.toBackchannelParameters()); ClientCredentials clientCredentials = clientAuthenticationHandler.authenticate(oAuthPushedRequestContext); verifier.verify(context, clientCredentials); authorizationRequestRepository.register(tenant, context.authorizationRequest()); log.info( "OAuth pushed request completed: client={}, request_uri={}", clientId.value(), context.authorizationRequest().identifier().value()); return oAuthPushedRequestContext; } public OAuthRequestContext handleRequest(OAuthRequest oAuthRequest) { OAuthRequestParameters parameters = oAuthRequest.toParameters(); Tenant tenant = oAuthRequest.tenant(); log.trace( "OAuth request started: client={}, response_type={}", parameters.clientId().value(), parameters.responseType().value()); OAuthRequestValidator validator = new OAuthRequestValidator(tenant, parameters); validator.validate(); AuthorizationServerConfiguration authorizationServerConfiguration = authorizationServerConfigurationQueryRepository.get(tenant); ClientConfiguration clientConfiguration = clientConfigurationQueryRepository.get(tenant, parameters.clientId()); OAuthRequestPattern oAuthRequestPattern = parameters.analyzePattern(); OAuthRequestContextCreator oAuthRequestContextCreator = oAuthRequestContextCreators.get(oAuthRequestPattern); OAuthRequestContext context = oAuthRequestContextCreator.create( tenant, parameters, authorizationServerConfiguration, clientConfiguration, false); verifier.verify(context); if (!context.isPushedRequest()) { authorizationRequestRepository.register(tenant, context.authorizationRequest()); } // Set OPSession for prompt=none handling OPSession opSession = oAuthRequest.opSession(); if (opSession != null && opSession.exists() && opSession.isActive()) { context.setOPSession(opSession); AuthorizationGranted authorizationGranted = grantedRepository.find(tenant, parameters.clientId(), opSession.user()); context.setAuthorizationGranted(authorizationGranted); } return context; } /** * RFC 9449 §10.1: PAR + DPoP integration. * *
If a DPoP proof is presented at the PAR endpoint: * *
If no DPoP proof is presented, the parameters pass through unchanged (the {@code dpop_jkt}
* parameter, if any, has already been validated upstream by RFC 9449 §10).
*/
private OAuthRequestParameters applyDPoPProofToParameters(
OAuthPushedRequest pushedRequest,
OAuthRequestParameters requestParameters,
Tenant tenant,
AuthorizationServerConfiguration authorizationServerConfiguration) {
if (pushedRequest.dpopProofHeaders().isEmpty()) {
return requestParameters;
}
DPoPProof dpopProof = new DPoPProof(pushedRequest.dpopProofHeaders().get(0));
DPoPProofVerifiedResult dpopResult =
new DPoPProofVerifier()
.verifyIfNeeded(
dpopProof,
pushedRequest.httpMethod(),
pushedRequest.httpUri(),
authorizationServerConfiguration.dpopSigningAlgValuesSupported());
if (!dpopResult.exists()) {
return requestParameters;
}
String proofJkt = dpopResult.jwkThumbprint().value();
if (requestParameters.hasDPoPJkt() && !requestParameters.dpopJkt().value().equals(proofJkt)) {
throw new OAuthBadRequestException(
"invalid_request",
"dpop_jkt parameter does not match the JWK thumbprint of the DPoP proof",
tenant);
}
Map