Skip to content

Commit dc8c67a

Browse files
committed
Reverting changes related to the supported_scopes
Revert #83
1 parent 55878e6 commit dc8c67a

File tree

1 file changed

+1
-44
lines changed

1 file changed

+1
-44
lines changed

openid-sharedsignals-framework-1_0.md

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -537,43 +537,10 @@ critical_subject_members
537537

538538
> OPTIONAL. An array of member names in a Complex Subject which, if present in
539539
a Subject Member in an event, MUST be interpreted by a Receiver.
540-
541-
supported_scopes
542-
543-
> OPTIONAL. A list of OAuth {{RFC6749}} scope names that the Transmitter supports for specific endpoints. The value of this field is a JSON object that has the endpoint names as keys, and arrays of scope name strings they support as their values. OAuth tokens obtained using any of the scopes defined here MUST be accepted by the specified endpoint. Any key that is not defined as an endpoint in the Transmitter Configuration Metadata MUST be ignored. If the supported_scopes member is present in the metadata and an endpoint is not listed as a key, then that endpoint MUST not require OAuth for authorization.
544-
545-
authorization_servers
546-
547-
> OPTIONAL. An array of supported authorization servers and the scopes they support. Each element of the array is a Authorization Server Descriptor JSON object defined in the section {{authz-server-descriptor}} below. If the `supported_scopes` member is present in the metadata, then the `authorization_servers` MUST also be present, and it MUST provide a server location for every supported scope.
548540

549541
TODO: consider adding a IANA Registry for metadata, similar to Section 7.1.1 of
550542
{{RFC8414}}. This would allow other specs to add to the metadata.
551543

552-
### Authorization Server Descriptor {#authz-server-descriptor}
553-
An Authorization Server Descriptor is a JSON object that has two keys:
554-
555-
scopes
556-
557-
> REQUIRED. An array of scope names supported by the authorization server
558-
559-
servers
560-
561-
> REQUIRED. An array of authorization server URLs. This is the URL from which the Authorization Server Metadata MAY be obtained by following the process described in Section 3 of RFC8414 {{RFC8414}}
562-
563-
The following is a non-normative example of an Authorization Server Descriptor
564-
565-
~~~ json
566-
{
567-
"scopes" : ["scope1", "scope2"],
568-
"servers": [
569-
"https://server1.example/base/url",
570-
"https://server2.example/base/url",
571-
"https://server3.example/base/url"
572-
]
573-
}
574-
~~~
575-
{: #authz-descriptor-example title="Example Authorization Server Descriptor"}
576-
577544
## Obtaining Transmitter Configuration Information
578545

579546
Using the Issuer as documented by the Transmitter, the Transmitter Configuration
@@ -670,17 +637,7 @@ Content-Type: application/json
670637
"https://tr.example.com/ssf/mgmt/subject:remove",
671638
"verification_endpoint":
672639
"https://tr.example.com/ssf/mgmt/verification",
673-
"critical_subject_members": [ "tenant", "user" ],
674-
"supported_scopes":
675-
{
676-
"status_endpoint": ["status_scope"],
677-
"configuration_endpoint": ["admin_scope", "status_scope"]
678-
},
679-
"authorization_servers": [
680-
{
681-
"scopes": ["admin_scope", "status_scope"],
682-
"servers": ["https://myauthzserver.example"]
683-
}
640+
"critical_subject_members": [ "tenant", "user" ]
684641
]
685642
}
686643
~~~

0 commit comments

Comments
 (0)