invalid_
Registry Context
Error code indicating that a software statement presented during dynamic client registration is invalid.
Technical Summary
RFC 7591 defines `invalid_software_statement` for a client registration error response when the presented software statement is invalid. Registration error responses use HTTP 400 with an `application/json` JSON object unless otherwise specified.
When Used
When a software statement presented in a dynamic client registration request is invalid.
Normative Requirements
Authorization servers
RFC 7591 - Section 3.2.2
include an `error` member containing a single ASCII error code string in the JSON error response..
Condition: When returning a client registration error response.
error REQUIRED. Single ASCII error code string.
RFC 7591 - Section 3.2.2
include other members in the JSON error object..
Condition: When returning a client registration error response.
Other members MAY also be included
RFC 7591 - Section 3.2.2
include an `error_description` member containing human-readable ASCII text for debugging..
Condition: When returning a client registration error response.
error_description OPTIONAL.
application
RFC 7591 - Section 2.3
specify the use of signature algorithms other than `RS256`..
particular applications MAY specify the use of different algorithms
recipient
RFC 7591 - Section 3.2.2
ignore other members in the JSON error object that it does not understand..
Condition: When the error response contains unrecognized members.
if they are not understood, they MUST be ignored
software statement
RFC 7591 - Section 2.3
be digitally signed or MACed using JSON Web Signature (JWS)..
Condition: When presented to the authorization server as part of a client registration request.
MUST be digitally signed or MACed using JSON Web Signature (JWS)
RFC 7591 - Section 2.3
contain an `iss` issuer claim identifying the party attesting to its claims..
Condition: When presented to the authorization server as part of a client registration request.
MUST contain an "iss" (issuer) claim
RFC 7591 - Section 2.3
contain the `software_id` claim so authorization servers can correlate different instances of software using the same software statement..
RECOMMENDED that software statements contain the "software_id" claim
software statement issuer
RFC 7591 - Section 2.3
digitally sign software statements using the `RS256` signature algorithm..
RECOMMENDED that software statements be digitally signed using the "RS256" signature algorithm
Validation Guidance
Verify that a registration error response uses HTTP 400 and `application/json` unless otherwise specified.
Verify that the response includes an `error` member containing a single ASCII error code string.
Allow an optional human-readable ASCII `error_description` member.
Allow additional members in the error object and ignore those that are not understood.
Verify that a software statement presented in a registration request is JWS-signed or MACed.
Verify that a software statement presented in a registration request contains an `iss` claim.
Prefer `RS256` for digitally signed software statements unless the application specifies another algorithm.
Prefer inclusion of a `software_id` claim to support correlation of software instances.
Reference
Details
- Entry Id
invalid_software_ statement - Name
invalid_software_ statement - Usage Location
registration endpoint- Protocol Extension
Dynamic Client Registration- Change Controller
IETF- Reference
RFC7591 - Section 3.2.2