diff --git a/openid-federation-1_0.xml b/openid-federation-1_0.xml index b475d30..3011148 100644 --- a/openid-federation-1_0.xml +++ b/openid-federation-1_0.xml @@ -475,6 +475,9 @@ The Entity Statement is signed using one of the private keys of the issuer Entity in the form of a JSON Web Signature (JWS). + Signing algorithms supported by the Entity MAY be declared using the + entity_statement_signing_alg_values_supported + Federation Entity metadata parameter defined in . Implementations SHOULD support signature verification with the RSA SHA-256 algorithm because OpenID Connect Core requires support for it (alg @@ -1232,6 +1235,14 @@ All Federation Entities MAY publish a federation_historical_keys_endpoint. + + + OPTIONAL. + JSON array containing a list of the JWS signing algorithms + (alg values) + supported by the Entity to sign Entity Statements. + If omitted, the default value is ["RS256"]. + @@ -1241,7 +1252,7 @@
- The following is a non-normative example of the federation_entity Entity Type: + The following is a non-normative example of metadata for the federation_entity Entity Type: Example of federation_entity Entity Type @@ -1254,6 +1265,10 @@ "https://amanita.caesarea.example.com/federation_list", "federation_trust_mark_status_endpoint": "https://amanita.caesarea.example.com/status", "federation_trust_mark_list_endpoint": "https://amanita.caesarea.example.com/trust_marked_list", + "entity_statement_signing_alg_values_supported": [ + "ES256", + "RS256" + ], "organization_name": "Ovulo Mushroom", "homepage_uri": "https://amanita.caesarea.example.com" } @@ -5356,6 +5371,10 @@ Content-Type: application/json "federation_entity": { "contacts": ["ops@sunet.se"], "federation_fetch_endpoint": "https://sunet.se/openid/fedapi", + "entity_statement_signing_alg_values_supported": [ + "ES256", + "ES384" + ], "homepage_uri": "https://www.sunet.se", "organization_name": "SUNET" }, @@ -9825,7 +9844,8 @@ Host: op.umu.se -40 - TBD + Fixed #65: Defined entity_statement_signing_alg_values_supported + Federation Entity metadata parameter.