Overview
ISO/IEC 26133:2024 - Information technology - OpenID Connect Dynamic Client Registration 1.0 (incorporating errata set 2) standardizes how an OpenID Connect Relying Party (Client) dynamically registers with an OpenID Provider (OP). Built on top of OAuth 2.0, it defines REST-like registration and management of client metadata, how Clients obtain an OAuth 2.0 Client ID, and how registration information is retrieved and updated in a secure, interoperable way.
Key Topics and Technical Requirements
- Client Metadata: Defines required and optional metadata such as redirect_uris, response_types, grant_types, application_type, contacts, client_name, logo_uri, policy_uri, tos_uri, jwks_uri and jwks. These values are input to registration requests and output in registration responses.
- Client Registration Endpoint: REST endpoint for initial dynamic registration. Specifies request/response payloads and error handling.
- Client Configuration Endpoint: Endpoint for reading and managing a registered Client’s configuration; includes use of a Registration Access Token to secure access.
- Tokens: Distinguishes Registration Access Token (for managing client registration) and optional Initial Access Token (service-specific, for restricting access to registration endpoint).
- JWK Management: Support for jwks_uri (recommended for key rotation) and jwks (by-value JWK Set for limited use cases). JWK Sets must not include private or symmetric keys.
- Identifier and Privacy Controls: sector_identifier_uri for pairwise subject identifier calculations and subject_type (pairwise or public).
- ID Token / UserInfo Security: Parameters for id_token_signed_response_alg, id_token_encrypted_response_alg/enc, userinfo_signed_response_alg, and userinfo_encrypted_response_alg to control signing/encryption requirements (default signing alg RS256; default enc example A128CBC-HS256 where applicable).
- Validation & String Operations: Rules for exact matching of redirect URIs and string comparisons per RFCs; normalization and validation guidance.
- Security Considerations: Addresses impersonation risks, native app leakage, and TLS requirements. Also covers implementation considerations including stateless dynamic registration patterns.
- IANA Considerations & Registries: Metadata and token authentication registries for extensibility.
Practical Applications and Who Should Use It
- Identity and access management architects designing OpenID Connect Providers (OPs).
- Application developers and SSO integrators implementing dynamic onboarding of Relying Parties (web, mobile, native).
- Security engineers who must enforce token protection, TLS, and key rotation policies.
- Platform operators automating client provisioning and lifecycle management to improve scalability and reduce manual configuration.
- Vendors building identity servers, OAuth/OIDC middleware, and interoperability/test harnesses.
Related Standards (for implementation)
- OAuth 2.0 (RFC 6749)
- OpenID Connect Core 1.0 and Discovery 1.0
- JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), JWT, JWA
- RFCs referenced for URI and JSON handling (e.g., RFC3986, RFC8259)
Keywords: ISO/IEC 26133:2024, OpenID Connect dynamic client registration, OAuth 2.0 client registration, client metadata, jwks_uri, registration access token, sector_identifier_uri.