oauth2.dev

software_statement

IESG

Registry Context

An optional dynamic client registration parameter containing a JWT that conveys client metadata. The statement must be protected with JWS and identify its issuer. A server that supports software statements must prefer their metadata over conflicting plain JSON metadata.

Technical Summary

The `software_statement` member is a string containing a software statement JWT whose claims convey client metadata. When presented in a registration request, the statement must be digitally signed or MACed using JWS and contain an `iss` claim. An authorization server may ignore it if unsupported; otherwise, statement-derived metadata takes precedence over plain JSON elements.

When Used

Used when client metadata is conveyed in a software statement during dynamic client registration.

Normative Requirements

Clients

MAY
1

  1. RFC 7591 - Section 3.1.1

    provide client metadata values in a software statement in addition to JSON elements.

    Condition: in a client registration request

    client metadata values MAY also be provided in a software statement

Authorization servers

MUST
1

  1. RFC 7591 - Section 3.1.1

    give client metadata values conveyed in the software statement precedence over those conveyed using plain JSON elements.

    Condition: if the server supports software statements

    client metadata values conveyed in the software statement MUST take precedence

MAY
2

  1. RFC 7591 - Section 2.3

    accept a software statement value directly as a client identifier in an authorization request.

    Condition: without prior dynamic client registration, in some cases

    authorization servers MAY choose to accept a software statement value directly as a client identifier

  2. RFC 7591 - Section 3.1.1

    ignore the software statement.

    Condition: if it does not support this feature

    The authorization server MAY ignore the software statement if it does not support this feature

particular application

MAY
1

  1. RFC 7591 - Section 2.3

    specify the use of algorithms other than `RS256`.

    particular applications MAY specify the use of different algorithms

software statement

MUST
2

  1. RFC 7591 - Section 2.3

    be digitally signed or MACed using JSON Web Signature (JWS).

    Condition: when presented to the authorization server as part of a client registration request

    the software statement MUST be digitally signed or MACed using JSON Web Signature (JWS)

  2. RFC 7591 - Section 2.3

    contain an `iss` issuer claim denoting the party attesting to its claims.

    Condition: when presented to the authorization server as part of a client registration request

    MUST contain an "iss" (issuer) claim

RECOMMENDED
1

  1. RFC 7591 - Section 2.3

    contain the `software_id` claim so authorization servers can correlate different software instances using the same statement.

    It is RECOMMENDED that software statements contain the "software_id" claim

software statement issuer

RECOMMENDED
1

  1. RFC 7591 - Section 2.3

    digitally sign software statements using the `RS256` signature algorithm.

    It is RECOMMENDED that software statements be digitally signed using the "RS256" signature algorithm

software_statement member

OPTIONAL
1

  1. RFC 7591 - Section 3.1.1

    be included in the requesting JSON object.

    Software statements are included in the requesting JSON object using this OPTIONAL member

Validation Guidance

error

When processing a software statement in a registration request, verify that it is digitally signed or MACed using JWS and contains an `iss` claim.

warning

Warn when a software statement is not signed using `RS256`, unless the application specifies another algorithm.

warning

Warn when a software statement omits the recommended `software_id` claim.

error

If software statements are supported, verify that their client metadata values override conflicting plain JSON values.

warning

A server may ignore a software statement only under the RFC's stated condition that it does not support the feature.

info

When rejecting an invalid or unapproved software statement, use the applicable `invalid_software_statement` or `unapproved_software_statement` registration error code.

Reference

RFC7591

Details

Entry Id
software_statement
Client Metadata Name
software_statement
Client Metadata Description
A software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
Change Controller
IESG
Reference
RFC7591