Keep identities and protections distinct
05Unique server identities and consistent issuer signals matter, while a plain parameter supplies no signature.
The ordinary response parameter is readable and unsigned. Correct issuer correlation is distinct from cryptographic integrity. A suitable validated JARM response or authorization-endpoint ID Token can supply the issuer by other means, with their additional checks.
Source for this drawing: RFC 9207 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A key is different from permission.
An app, a person, and a server have different roles. Follow who asks, who grants permission, and who checks the credential. A key in the drawing is an analogy, not a literal protocol field.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Issuer correlation, response integrity and user authentication solve different problems.
- Clients MUST NOT allow several authorization servers to share the same issuer identifier. Manually configured accepted issuer values MUST be unique for each server.
- If an authorization response also returns an OpenID Connect ID Token from the authorization endpoint, its iss claim MUST equal the iss parameter. Clients MUST reject multiple issuer identifiers that disagree.
- When an issuer is already conveyed and checked by a suitable alternative, such as an authorization-endpoint ID Token or JARM, the extra iss parameter MAY be omitted. JARM is a JWT response envelope; its issuer must still be validated. Full alternative-mode processing is outside this guide.
- The plain iss parameter is not cryptographically protected against tampering. It counters mix-up under the described model; it does not make a response signed, encrypted or fully trustworthy. TLS and the rest of OAuth security still matter.
A token-endpoint-only ID Token arrives too late to replace this authorization-response check. No real ID Token, JARM signature, client credential or account is used here.
Read the RFC section ↗