<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr">Hi</div><div dir="ltr"><br></div><div dir="ltr">The example to give is I think not legal as per <a href="https://www.rfc-editor.org/rfc/rfc9126.html#section-3">https://www.rfc-editor.org/rfc/rfc9126.html#section-3</a></div><div dir="ltr"><br></div><div dir="ltr">Even if it were technically legal, you can not expect conformant clients to send requests like that.</div><div dir="ltr"><br></div><div dir="ltr">If you have implemented your authorization server already you can verify compliance by running the fapi certification tests. They are free to run:</div><div dir="ltr"><br></div><div dir="ltr"><div style="display: block;" class=""><div style="-webkit-user-select: all; -webkit-user-drag: element; display: inline-block;" class="apple-rich-link" draggable="true" role="link" data-url="https://openid.net/certification/certification-fapi_op_testing/"><a style="border-radius:10px;font-family:-apple-system, Helvetica, Arial, sans-serif;display:block;-webkit-user-select:none;width:300px;user-select:none;-webkit-user-modify:read-only;user-modify:read-only;overflow:hidden;text-decoration:none;" class="lp-rich-link" rel="nofollow" href="https://openid.net/certification/certification-fapi_op_testing/" dir="ltr" role="button" draggable="false" width="300"><table style="table-layout:fixed;border-collapse:collapse;width:300px;background-color:#E9E9EB;font-family:-apple-system, Helvetica, Arial, sans-serif;" class="lp-rich-link-emailBaseTable" cellpadding="0" cellspacing="0" border="0" width="300"><tbody><tr><td vertical-align="center" align="center"><img style="width:300px;filter:brightness(0.97);height:156px;" width="300" height="156" draggable="false" class="lp-rich-link-mediaImage" alt="OG.jpg" src="cid:5938836F-601B-47D6-AF77-B9D72086DD4D"></td></tr><tr><td vertical-align="center"><table bgcolor="#E9E9EB" cellpadding="0" cellspacing="0" width="300" style="font-family:-apple-system, Helvetica, Arial, sans-serif;table-layout:fixed;background-color:rgba(233, 233, 235, 1);" class="lp-rich-link-captionBar"><tbody><tr><td style="padding:8px 0px 8px 0px;" class="lp-rich-link-captionBar-textStackItem"><div style="max-width:100%;margin:0px 16px 0px 16px;overflow:hidden;" class="lp-rich-link-captionBar-textStack"><div style="word-wrap:break-word;font-weight:500;font-size:12px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-topCaption-leading"><a rel="nofollow" href="https://openid.net/certification/certification-fapi_op_testing/" style="text-decoration: none" draggable="false"><font color="#000000" style="color: rgba(0, 0, 0, 1);">Conformance Testing for FAPI Read/Write and FAPI1Advanced-Final OPs - OpenID Foundation</font></a></div><div style="word-wrap:break-word;font-weight:400;font-size:11px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-bottomCaption-leading"><a rel="nofollow" href="https://openid.net/certification/certification-fapi_op_testing/" style="text-decoration: none" draggable="false"><font color="#A2A2A9" style="color: rgba(60, 60, 67, 0.6);">openid.net</font></a></div></div></td></tr></tbody></table></td></tr></tbody></table></a></div></div><br></div><div dir="ltr"><br></div><div dir="ltr">Thanks</div><div dir="ltr"><br></div><div dir="ltr">Joseph</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">On 15 Dec 2023, at 19:56, Rivindu Madushan <rivindu.madushan@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Hi Joseph,<div><br></div><div>Thank you for the quick response. </div><div><br></div><div>I'm clear on the Authorization Endpoint call. My doubt is on the /par POST call. Whether an authorization server can expect the client is sending those parameters( response_type, client_id, and scope) in the request body of the PAR POST call other than the request object as follows?</div><div><br></div><div><font size="1" style="background-color:rgb(238,238,238)">POST /oauth2/par HTTP/1.1<br>Host: localhost:9443<br>Cache-Control: no-cache<br>Content-Type: application/x-www-form-urlencoded;charset=utf-8<br>Content-Length: 153<br><br>client_id=1234&redirect_uri=<a href="http://www.someurl.com">www.someurl.com</a>&scope=account openid&request={{request_object}}&response_type=code id_token</font><br></div><div><font size="1" style="background-color:rgb(238,238,238)"><br></font></div><div>Thanks & Regards,</div><div>Rivindu</div><div><font size="1" style="background-color:rgb(238,238,238)"><br></font></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Dec 15, 2023 at 3:48 PM Joseph Heenan <<a href="mailto:joseph@authlete.com">joseph@authlete.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Hi Rivindu<div><br></div><div>Is your question whether the server must support an Authorization Endpoint call in the form:</div><div><br></div><div><a href="https://as.example.com/authorize?client_id=1234&request_uri=foo" target="_blank">https://as.example.com/authorize?client_id=1234&request_uri=foo</a></div><div><br></div><div>(i.e. without the response_type)</div><div><br></div><div>If so then the answer is yes, FAPI conformance servers that support PAR must accept Authorization Endpoint calls with the response_type/etc not present. I think there were a few reasons why we decided that, but at least part of it was the desire not to expose information (like the scope being requested) to the browser in the Authorization Endpoint call.</div><div><br></div><div>Cheers,</div><div><br></div><div>Joseph</div><div><br id="m_-1157687215381363758lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 15 Dec 2023, at 18:15, Nat Sakimura via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" target="_blank">openid-specs-fapi@lists.openid.net</a>> wrote:</div><br><div><div dir="auto"><div>This question was sent to the list owner instead of the list. So I am forwarding <br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Rivindu Madushan</strong> <span dir="auto"><<a href="mailto:rivindu.madushan@gmail.com" target="_blank">rivindu.madushan@gmail.com</a>></span><br>Date: 2023年12月15日(金) 14:37<br>Subject: Support FAPI PAR without JAR(rfc 9101)<br>To: <<a href="mailto:openid-specs-fapi-owner@lists.openid.net" target="_blank">openid-specs-fapi-owner@lists.openid.net</a>><br></div><br><br><div dir="ltr">Hi team,<div><br></div><div>This is regarding the use of Pushed authorization requests according to the FAPI specification.</div><div><br></div><div>According to the specification 5.2.3-8[1], for the authorization request, clients must send all the parameters inside the authorization requests' request object. It doesn't mention about the /par call. As per the PAR specification[2], if the OP supports JAR[3], then all the parameters must be sent inside the request object for the /par call. </div><div><br></div><div>My question is can there be an OP, who supports FAPI while not having the support for JAR(RFC 9101). ie. It expects the client to send the duplicates of the response_type, client_id, and scope parameters in the /par call?</div><div><br></div><div>Highly appreciate your insight on this.</div><div><br></div><div>[1] <a href="https://openid.net/specs/openid-financial-api-part-2-1_0.html#confidential-client" rel="noreferrer" target="_blank">https://openid.net/specs/openid-financial-api-part-2-1_0.html#confidential-client</a></div><div>[2] <a href="https://datatracker.ietf.org/doc/html/rfc9126#name-the-request-request-paramet" rel="noreferrer" target="_blank">https://datatracker.ietf.org/doc/html/rfc9126#name-the-request-request-paramet</a></div><div>[3] <a href="https://datatracker.ietf.org/doc/html/rfc9101" rel="noreferrer" target="_blank">https://datatracker.ietf.org/doc/html/rfc9101</a><br clear="all"><div><br></div><div>Thanks & Regards,</div><div>Rivindu</div></div></div>
</div></div></div>
_______________________________________________<br>Openid-specs-fapi mailing list<br><a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br><a href="https://lists.openid.net/mailman/listinfo/openid-specs-fapi" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br></div></blockquote></div><br></div></div></blockquote></div>
</div></blockquote></body></html>