tegwick
1353267569
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a087b0-7b1e-7531-8ef3-6525ebaf7ee7
173 lines
5 KiB
YAML
173 lines
5 KiB
YAML
fiam_version: '0.2'
|
|
instance:
|
|
id: specimen.oidc.authorization-code
|
|
kind: specimen
|
|
title: OIDC Authorization Code Flow
|
|
status: provisional
|
|
intent: Exercise multi-party choreography, browser-mediated redirects, token exchange, and layered identity semantics.
|
|
nodes:
|
|
- id: node.user-agent
|
|
kind: system-node
|
|
name: Browser
|
|
node_type: fiam.node-type.user-agent
|
|
- id: node.relying-party
|
|
kind: system-node
|
|
name: Relying Party
|
|
node_type: fiam.node-type.application
|
|
- id: node.authorization-server
|
|
kind: system-node
|
|
name: OpenID Provider
|
|
node_type: fiam.node-type.identity-provider
|
|
ports:
|
|
- id: port.rp.authn
|
|
owner: node.relying-party
|
|
participations:
|
|
- contract: contract.oidc
|
|
mode: requires
|
|
roles:
|
|
- fiam.role.oidc-client
|
|
- id: port.op.authorization
|
|
owner: node.authorization-server
|
|
participations:
|
|
- contract: contract.oidc
|
|
mode: offers
|
|
roles:
|
|
- fiam.role.authorization-server
|
|
- id: port.op.token
|
|
owner: node.authorization-server
|
|
participations:
|
|
- contract: contract.oidc
|
|
mode: offers
|
|
roles:
|
|
- fiam.role.token-issuer
|
|
contracts:
|
|
- id: contract.oidc
|
|
kind: interface-contract
|
|
purpose:
|
|
- fiam.purpose.authentication
|
|
- fiam.purpose.identity-federation
|
|
contract_forms:
|
|
- fiam.contract-form.oidc
|
|
operations:
|
|
- id: operation.authorization-request
|
|
name: authorization request
|
|
interaction_style: fiam.interaction-style.redirect-request
|
|
- id: operation.authorization-response
|
|
name: authorization response
|
|
interaction_style: fiam.interaction-style.redirect-response
|
|
- id: operation.token-request
|
|
name: token request
|
|
interaction_style: fiam.interaction-style.request-response
|
|
endpoints:
|
|
- id: endpoint.authorization
|
|
kind: endpoint
|
|
address: https://idp.example.test/authorize
|
|
address_scheme: fiam.address-scheme.https-url
|
|
- id: endpoint.token
|
|
kind: endpoint
|
|
address: https://idp.example.test/token
|
|
address_scheme: fiam.address-scheme.https-url
|
|
bindings:
|
|
- id: binding.oidc.authorization-https
|
|
contract: contract.oidc
|
|
provider_port: port.op.authorization
|
|
consumer_ports:
|
|
- port.rp.authn
|
|
operations:
|
|
- operation.authorization-request
|
|
- operation.authorization-response
|
|
binding_profile: fiam.binding-profile.oidc-http
|
|
communication_stack:
|
|
- role: fiam.stack-role.identity-protocol
|
|
term: fiam.protocol.openid-connect
|
|
- role: fiam.stack-role.authorization-framework
|
|
term: fiam.protocol.oauth2
|
|
- role: fiam.stack-role.application-transfer-protocol
|
|
term: fiam.protocol.http
|
|
- role: fiam.stack-role.security-protocol
|
|
term: fiam.protocol.tls
|
|
- role: fiam.stack-role.transport
|
|
term: fiam.transport.tcp
|
|
endpoints:
|
|
- endpoint.authorization
|
|
- id: binding.oidc.token-https
|
|
contract: contract.oidc
|
|
provider_port: port.op.token
|
|
consumer_ports:
|
|
- port.rp.authn
|
|
operations:
|
|
- operation.token-request
|
|
binding_profile: fiam.binding-profile.oidc-http
|
|
communication_stack:
|
|
- role: fiam.stack-role.identity-protocol
|
|
term: fiam.protocol.openid-connect
|
|
- role: fiam.stack-role.authorization-framework
|
|
term: fiam.protocol.oauth2
|
|
- role: fiam.stack-role.application-transfer-protocol
|
|
term: fiam.protocol.http
|
|
- role: fiam.stack-role.security-protocol
|
|
term: fiam.protocol.tls
|
|
- role: fiam.stack-role.transport
|
|
term: fiam.transport.tcp
|
|
endpoints:
|
|
- endpoint.token
|
|
interaction_flows:
|
|
- id: flow.oidc.authorization-code
|
|
kind: interaction-flow
|
|
flow_type: fiam.flow.authentication-choreography
|
|
participants:
|
|
- node.user-agent
|
|
- node.relying-party
|
|
- node.authorization-server
|
|
steps:
|
|
- sequence: 1
|
|
operation: operation.authorization-request
|
|
binding: binding.oidc.authorization-https
|
|
from: node.relying-party
|
|
via: node.user-agent
|
|
to: node.authorization-server
|
|
- sequence: 2
|
|
operation: operation.authorization-response
|
|
binding: binding.oidc.authorization-https
|
|
from: node.authorization-server
|
|
via: node.user-agent
|
|
to: node.relying-party
|
|
- sequence: 3
|
|
operation: operation.token-request
|
|
binding: binding.oidc.token-https
|
|
from: node.relying-party
|
|
to: node.authorization-server
|
|
security:
|
|
- id: security.oidc
|
|
applies_to: flow.oidc.authorization-code
|
|
authentication: fiam.security.authentication.federated
|
|
credential_artifacts:
|
|
- fiam.credential.authorization-code
|
|
- fiam.credential.id-token
|
|
- fiam.credential.access-token
|
|
identity_propagation: fiam.security.identity-propagation.token
|
|
assertions:
|
|
- id: assertion.flow-required
|
|
subject: flow.oidc.authorization-code
|
|
predicate: fiam.property.multi-party
|
|
value: true
|
|
evidence:
|
|
mode: fiam.evidence.declared
|
|
source: OIDC protocol definition
|
|
confidence: 1.0
|
|
assertion_kind: property
|
|
polarity: asserted
|
|
tests:
|
|
stresses:
|
|
- multi-party-choreography
|
|
- browser-mediated-flow
|
|
- identity-overlay
|
|
notes:
|
|
- Authentication is modeled as a flow, not collapsed into one endpoint.
|
|
expected_properties:
|
|
- id: check.evidence
|
|
kind: all-assertions-have-evidence
|
|
- id: check.no-deprecated
|
|
kind: no-deprecated-terms
|
|
- id: check.no-legacy-representations
|
|
kind: no-legacy-representations
|