Financial-grade API Security Profile 1.0 - Part 2: Advanced

[maennchen]

Spec: https://openid.net/specs/openid-financial-api-part-2-1_0.html

Work Required

• Based on Financial-grade API Security Profile 1.0 - Part 1: Baseline #246
• Support JARM (with setting to require it)
• Support PAR - feat: Pushed Authorization Request (PAR) #313
• Add configuration that restricts the client to more safe settings
  • Check s_hash in ID token (based on state)
  • Require signed request object
  • More restictive mTLS settings: TLS considerations
  • No none algorithm
  • No RSASSA-PKCS1-v1_5 algorithms like RS256
  • jwks_uri require HTTPS
  • No JWE x5u / jku
  • Unique kid for JWK Sets (consider alg / use / kty and crv)

📌 This issue is here to track interest for the implementation. Upvote if you would like this implemented.