OKTA-1232140 XAA metadata discovery - #6353
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Acrolinx scoreA minimum Acrolinx Score of 80 is required. The total score is an average of the subscores.
Successfully checked 3 of 3 documents. Reopen the pull request or push new changes to check again. Depending on the Acrolinx server configuration, the |
|
|
||
| To establish a Cross App Access (XAA) connection to your resource app and its authorization server, requesting clients need to understand how your app handles token exchanges and authorization. | ||
|
|
||
| When you build an XAA resource app, provide discovery metadata through a standard, well-known URI so that requesting apps can determine your OAuth 2.0 protected resources information. See [RFC 9782: OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). |
There was a problem hiding this comment.
| When you build an XAA resource app, provide discovery metadata through a standard, well-known URI so that requesting apps can determine your OAuth 2.0 protected resources information. See [RFC 9782: OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). | |
| When you build an XAA resource app, provide discovery metadata through a standard, well-known URI so that requesting apps can determine your OAuth 2.0 protected resources information. See [RFC 9728: OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728). |
|
|
||
| | Property | Type | Description | | ||
| | --- | --- | --- | | ||
| | `resource` | String | The canonical URI identifying your protected resource server. This value must match the `aud` (audience) claim in incoming ID-JAG token. | |
There was a problem hiding this comment.
This value must match the
aud(audience) claim in incoming ID-JAG token.
The aud claim in the ID-JAG is the authorization server identifier, not resource server identifier.
|
|
||
| ### Required properties | ||
|
|
||
| Your protected resource metadata response must return a JSON object conforming to [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) with the following properties: |
There was a problem hiding this comment.
| Your protected resource metadata response must return a JSON object conforming to [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) with the following properties: | |
| Your protected resource metadata response must return a JSON object conforming to [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) with at least the following properties: |
| { | ||
| "resource": "https://api.example.com", | ||
| "authorization_servers": [ | ||
| "https://example.okta.com/oauth2/austest123456" |
There was a problem hiding this comment.
| "https://example.okta.com/oauth2/austest123456" | |
| "https://auth.example.com" |
Let's avoid using an Okta authorization server here because the main audience for this will have their own authorization server.
|
|
||
| Now that your discovery metadata URIs are configured and verified: | ||
|
|
||
| * [Validate ID-JAG tokens]: Extend your authorization server to validate the ID-JAG token and resolve the user’s identity before issuing scoped access tokens. |
There was a problem hiding this comment.
are these supposed to be links?
2 participants
Description:
Resolves:
Vercel Preview Link:
Preview