Map OpenID Connect registration settings onto lab-collage

Setup

1. You need lab-collage with its lab-collage ID token manager on key B, Ava, ID_ALGS, and rp_discover with the redefined helpers from the provider discovery lab. Run rp_discover "$ISSUER" and keep btl-lab callback running.

2. Press Start.

Walkthrough

1. Write registration.json for lab-collage with the lesson's standard names, filled from the client screen and the ID token manager:

jq -n --arg id "$CLIENT_ID" '{client_id: $id,
  redirect_uris: ["http://127.0.0.1:8765/callback", "https://beyondthelogin.dev/lab/callback/"],
  token_endpoint_auth_method: "client_secret_basic", scope: "openid profile email photos.read", application_type: "web",
  id_token_signed_response_alg: "RS256", subject_type: "public", require_auth_time: true, default_max_age: 3600,
  post_logout_redirect_uris: ["https://beyondthelogin.dev/lab/callback/"]}' > registration.json

2. Mark each field as configurable here, fixed, or missing:

Why it matters: the names are the ones a client uses when it registers through an API. Knowing which are real here tells you which decisions your relying party must still enforce itself.

3. Prove the require_auth_time behavior. In a window where Ava is signed in, run signin_url 'openid' and exchange. The tenant asks nothing, and btl-lab decode "$ID_TOKEN" still shows auth_time, the time of her earlier sign-in.

4. Try registering the way the lesson's API would:

curl -si -X POST "$ISSUER/oauth/register" -H 'Content-Type: application/json' -d @registration.json | head -3

The tenant answers 501: dynamic registration is not available, so registrations are made in the tenant portal.

5. Exact return addresses. lab-collage already has two registered return addresses, the loopback listener and the hosted callback page. Run signin_url 'openid' and replace the encoded redirect_uri with https%3A%2F%2Fbeyondthelogin.dev%2Flab%2Fcallback%2F. The hosted page shows the code, because that address is registered exactly. Now remove the final %2F and open it again: the tenant shows its own error page and never redirects.

Why it matters: the lesson keeps sign-in on its own return address. Exact matching is what makes that separation enforceable.

6. Algorithm agreement. Your ID_ALGS and the manager's key describe the same decision from two sides. In the validation failure lab, moving the manager to ES256 key D changed the effective id_token_signed_response_alg without changing your allowlist, and every sign-in failed at the algorithm check until both sides agreed. Note in registration.json that the two must change together.

Planned walkthrough

These steps run once dynamic registration (G9), per-client OpenID Connect defaults (G60), pairwise subjects (G18), authentication context (G20) and logout addresses (G17) exist.

1. Register through the API:

POST $ISSUER/oauth/register HTTP/1.1
Content-Type: application/json

{"redirect_uris": ["https://beyondthelogin.dev/lab/callback/"], "client_name": "lab-tmp-registered", "token_endpoint_auth_method": "client_secret_basic", "scope": "openid profile", "id_token_signed_response_alg": "RS256", "subject_type": "public", "require_auth_time": true, "default_max_age": 300}

The tenant answers 201 with client_id, client_secret, a registration_access_token and a registration_client_uri. Read the registration back with the access token, change default_max_age, and finally delete lab-tmp-registered.

2. Set default_max_age to 300 on lab-collage. Sign in more than five minutes after Ava's last password sign-in, with no max_age in the request: the tenant asks for her password and auth_time is fresh. Send max_age=3600 in a request and see it override the default.

3. Set default_acr_values and check the acr in the token, as the authentication context lessons describe.

4. Register post_logout_redirect_uris and the logout notification addresses, and use them in the logout labs.

Break it

1. A registration without openid. On lab-collage, set scopes to Assigned exclusive scopes only. openid is a common scope, so the client can no longer request it: the next signin_url 'openid' returns error=invalid_scope. Changing this setting also ends the client's existing tokens and consents.

Restore: set lab-collage scopes back to Common and assigned scopes, and run a sign-in to confirm openid works again (Ava approves consent once more).

2. A return address with one extra character. Run signin_url 'openid' with the encoded redirect_uri changed to http%3A%2F%2F127.0.0.1%3A8765%2Fcallback%2F. The tenant shows its error page, because a trailing slash makes it a different address.

Check your work

Press Check my progress. It looks for, in order: a code_issued sign-in for lab-collage, a tenant.oauth.clients.update (scopes restricted), oauth.authorize rejected with invalid_scope, and a second tenant.oauth.clients.update (scopes restored).

In Logs, oauth.register appears with not_implemented, and the unregistered return addresses appear as oauth.authorize rejected with invalid_redirect_uri. registration.json should be annotated for every field.

Cleanup

Confirm that lab-collage allows common and assigned scopes and still has exactly its two lab return addresses. Delete registration.json when you no longer need it.

Missing infrastructure

• G9 (dynamic client registration and management): /oauth/register returns 501. Planned step 1 will register lab-tmp-registered through the API, read and update it with the registration access token, and delete it.

• G60 (per-client OpenID Connect registration defaults): there is no per-client default_max_age, require_auth_time switch (auth_time is always issued), application_type or initiate_login_uri. Planned step 2 will show the default forcing a password after five minutes and a per-request max_age overriding it.

• G18 (pairwise subject identifiers): subject_type: pairwise and sector_identifier_uri are not offered. The claims labs approximate a per-sector sub until it exists.

• G20 (acr and acr_values): there is no default_acr_values, and acr_values is not supported. Planned step 3 will request and check an authentication context.

• G17 (OpenID Connect logout): there are no post_logout_redirect_uris, frontchannel_logout_uri or backchannel_logout_uri. Planned step 4 will register them for the logout labs.