Implement PAR

[leastprivilege]

track https://tools.ietf.org/html/draft-ietf-oauth-par-04

[TobiasAhnoff]

Hi! From the presentation "OAuth 2.1" and beyond (as always a great presentation!), I got the impression that PAR was ready to use (even though it still is a draft), but now I realized that it is a planned feature. What are the plans for PAR?

[leastprivilege]

As soon as the spec is finalized, we will add it.

[TobiasAhnoff]

Looking forward to that, thank you!

[bigheadedmonster]

Really looking forward to this :)

[brockallen]

As part of this, we think it will be necessary to pass the full validated request to the redirect uri validator.

[bigheadedmonster]

Getting access to the full validated request in the uri validator would be a welcome addition on its own :)

[brockallen]

Some internal notes I jotted down:

1: validate on PAR endpoint (refactor from authZ validator)
2: bypass validation for valid PAR request URI on authZ EP
3: allow client to have per-request redirect_uri (only for confidential clients, JAR). maybe this means we add which params are validated to the request object, and then pass that along to the URI validator.

[bigheadedmonster]

🥳

[bigheadedmonster]

Any comments on a more precise date for the PAR feature for identity server? :)

[leastprivilege]

We postpone PAR in favour of DPoP.

DPoP will come in the next version, PAR the version after that.

[brockallen]

related: #983