RFC7591 OAuth dynamic client registration + OpenID Connect Dynamic Client Registration (closes #136 closes #4)

crates/common/src/auth/oauth/config.rs

@@ -36,6 +36,9 @@ pub struct OAuthConfig {
     pub oauth_expiry_refresh_token_renew: u64,
     pub oauth_max_auth_attempts: u32,
 
+    pub allow_anonymous_client_registration: bool,
+    pub require_client_authentication: bool,
+
     pub oidc_expiry_id_token: u64,
     pub oidc_signing_secret: Secret,
     pub oidc_signature_algorithm: SignatureAlgorithm,
@@ -179,6 +182,12 @@ impl OAuthConfig {
                 .property_or_default::<Duration>("oauth.oidc.expiry.id-token", "15m")
                 .unwrap_or_else(|| Duration::from_secs(15 * 60))
                 .as_secs(),
+            allow_anonymous_client_registration: config
+                .property_or_default("oauth.client-registration.anonymous", "false")
+                .unwrap_or(false),
+            require_client_authentication: config
+                .property_or_default("oauth.client-registration.required", "false")
+                .unwrap_or(true),
             oidc_signing_secret,
             oidc_signature_algorithm,
             oidc_jwks,
@@ -197,6 +206,8 @@ impl Default for OAuthConfig {
             oauth_expiry_refresh_token_renew: Default::default(),
             oauth_max_auth_attempts: Default::default(),
             oidc_expiry_id_token: Default::default(),
+            allow_anonymous_client_registration: Default::default(),
+            require_client_authentication: Default::default(),
             oidc_signing_secret: Secret::Bytes("secret".to_string().into_bytes()),
             oidc_signature_algorithm: SignatureAlgorithm::HS256,
             oidc_jwks: Resource {

crates/common/src/auth/oauth/mod.rs

@@ -8,6 +8,7 @@ pub mod config;
 pub mod crypto;
 pub mod introspect;
 pub mod oidc;
+pub mod registration;
 pub mod token;
 
 pub const DEVICE_CODE_LEN: usize = 40;

crates/common/src/auth/oauth/registration.rs

@@ -0,0 +1,181 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs Ltd <hello@stalw.art>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Serialize, Deserialize, Debug, Default)]
+#[serde(rename_all = "snake_case")]
+pub struct ClientRegistrationRequest {
+    pub redirect_uris: Vec<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub response_types: Vec<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub grant_types: Vec<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub application_type: Option<ApplicationType>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub contacts: Vec<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logo_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub policy_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tos_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub jwks_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub jwks: Option<serde_json::Value>, // Using serde_json::Value for flexibility
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sector_identifier_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub subject_type: Option<SubjectType>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id_token_signed_response_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id_token_encrypted_response_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id_token_encrypted_response_enc: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub userinfo_signed_response_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub userinfo_encrypted_response_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub userinfo_encrypted_response_enc: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_object_signing_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_object_encryption_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_object_encryption_enc: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token_endpoint_auth_method: Option<TokenEndpointAuthMethod>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token_endpoint_auth_signing_alg: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_max_age: Option<u64>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub require_auth_time: Option<bool>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub default_acr_values: Vec<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub initiate_login_uri: Option<String>,
+
+    #[serde(default)]
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub request_uris: Vec<String>,
+
+    #[serde(flatten)]
+    #[serde(skip_serializing_if = "HashMap::is_empty")]
+    pub additional_fields: HashMap<String, serde_json::Value>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Default)]
+#[serde(rename_all = "snake_case")]
+pub struct ClientRegistrationResponse {
+    // Required fields
+    pub client_id: String,
+
+    // Optional fields specific to the response
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_secret: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub registration_access_token: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub registration_client_uri: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_id_issued_at: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_secret_expires_at: Option<u64>,
+
+    // Echo back the request
+    #[serde(flatten)]
+    pub request: ClientRegistrationRequest,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(rename_all = "lowercase")]
+pub enum ApplicationType {
+    Web,
+    Native,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(rename_all = "lowercase")]
+pub enum SubjectType {
+    Pairwise,
+    Public,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(rename_all = "snake_case")]
+pub enum TokenEndpointAuthMethod {
+    ClientSecretPost,
+    ClientSecretBasic,
+    ClientSecretJwt,
+    PrivateKeyJwt,
+    None,
+}