[Native SSO] DPoP support
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 0
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by Takahiko Kawasaki (Takahiko Kawasaki) on 2025-04-21
OpenID Connect Native SSO for Mobile Apps 1.0 - draft 07, Section 4.4. “Token Exchange Response” requires the token_type to be bearer.
token_typeREQUIRED. The value of this parameter MUST be
bearer.
This requirement prevents the specification from being used in conjunction with RFC 9449: OAuth 2.0 Demonstrating Prof of Possesion (DPoP), which uses DPoP as the token_type.
It would be better to adjust the wording of this requirement to allow Native SSO and DPoP to be used together.
Bitbucket status: new
Bitbucket origin: issue 2175
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read Section 4.4 of the OpenID Connect Native SSO for Mobile Apps draft and RFC 9449 first, focusing on the token exchange response and token_type requirements. Done means proposing and agreeing on specification wording that permits DPoP alongside Native SSO without leaving the response requirement ambiguous.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100