仕様

機能	Version	説明
標準仕様	1.1~	RFC 6749: The OAuth 2.0 Authorization Framework RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage RFC 7009: OAuth 2.0 Token Revocation RFC 7636: Proof Key for Code Exchange by OAuth Public Clients RFC 7662: OAuth 2.0 Token Introspection OAuth 2.0 Multiple Response Type Encoding Practices OAuth 2.0 Form Post Response Mode OpenID Connect Core 1.0 OpenID Connect Discovery 1.0
	2.0~	RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants RFC 8705: OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens Financial-grade API - Part 1: Read-Only API Security Profile Financial-grade API - Part 2: Read and Write API Security Profile UK Open Banking Security Profile
	2.1~	RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol RFC 7592: OAuth 2.0 Dynamic Client Registration Management Protocol RFC 8628: OAuth 2.0 Device Authorization Grant OpenID Connect Dynamic Client Registration 1.0 OpenID Connect Client Initiated Backchannel Authentication Flow - Core 1.0 Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) Financial-grade API: Client Initiated Backchannel Authentication Profile
	2.2~	RFC 8707: Resource Indicators for OAuth 2.0 RFC 9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR) RFC 9126: OAuth 2.0 Pushed Authorization Requests RFC 9207: OAuth 2.0 Authorization Server Issuer Identification OAuth 2.0 Rich Authorization Requests RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP) OpenID Connect for Identity Assurance 1.0 Australia Consumer Data Right Security Profile Open Banking Brasil Financial-grade API Security Profile
	2.3~	RFC 8693: OAuth 2.0 Token Exchange OpenID Connect Core Error Code unmet_authentication_requirements RFC 9470: OAuth 2.0 Step Up Authentication Challenge Protocol Grant Management for OAuth 2.0 Transformed Claims OpenID Connect Federation 1.0
	3.0~	FAPI 2.0 Security Profile Final & Message Signing Final FAPI 2.0 Security Profile FAPI 2.0 Message Signing FAPI 2.0 HTTP Signatures JWT Response for OAuth Token Introspection OAuth 2.0 Attestation-Based Client Authentication OpenID for Verifiable Credential Issuance 1.0 Implementer's Draft 1 Selective Disclosure for JWTs SD-JWT-based Verifiable Credentials (SD-JWT VC) ISO/IEC 18013-5:2021 Personal identification — ISO-compliant driving licence Part 5: Mobile driving licence (mDL) application
クライアント認証方式	1.1 ~	`none` `client_secret_basic` (RFC 6749) `client_secret_post` (RFC 6749)
	2.0 ~	`client_secret_jwt` (RFC 7523) `private_key_jwt` (RFC 7523) `tls_client_auth` (RFC 8705) `self_signed_tls_client_auth` (RFC 8705)
	3.0 ~	`attest_jwt_client_auth` (OAuth 2.0 Attestation-Based Client Authentication)
エンドポイント	1.1 ~	Authorization Endpoint (RFC 6749) Discovery Endpoint (OIDC Discovery 1.0) Introspection Endpoint (RFC 7662) JWK Set Endpoint (RFC 7517) Revocation Endpoint (RFC 7009) Token Endpoint (RFC 6749) UserInfo Endpoint (OIDC Core 1.0)
	2.1 ~	Backchannel Authentication Endpoint (CIBA Core 1.0) Device Authorization Endpoint (RFC 8628)
	2.2 ~	Pushed Authorization Request Endpoint (RFC 9126)
	2.3 ~	Grant Management Endpoint Federation Configuration Endpoint (OIDC Federation) Federation Registration Endpoint (OIDC Federation)
	3.0 ~	Credential Issuer Metadata Endpoint (OID4VCI 1.0 Implementer's Draft 1) Credential Endpoint (OID4VCI 1.0 Implementer's Draft 1) Batch Credential Endpoint (OID4VCI 1.0 Implementer's Draft 1) Deferred Credential Endpoint (OID4VCI 1.0 Implementer's Draft 1) JWT VC Issuer Metadata Endpoint (SD-JWT VC)
認可種別 (Grant Types)	1.1 ~	`authorization_code` (RFC 6749) `implicit` (RFC 6749) `password` (RFC 6749) `client_credentials` (RFC 6749) `refresh` (RFC 6749)
	2.1 ~	`urn:openid:params:grant-type:ciba` (CIBA Core) `urn:ietf:params:oauth:grant-type:device_code` (RFC 8628)
	2.3 ~	`urn:ietf:params:oauth:grant-type:token-exchange` (RFC 8693) `urn:ietf:params:oauth:grant-type:jwt-bearer` (RFC 7523)
	3.0 ~	`urn:ietf:params:oauth:grant-type:pre-authorized_code` (OID4VCI 1.0 Implementer's Draft 1)
応答種別 (Response Types)	1.1 ~	`code` (RFC 6749) `token` (RFC 6749) `id_token` (Multiple Response Type) `code token` (Multiple Response Type) `code id_token` (Multiple Response Type) `id_token token` (Multiple Response Type) `code id_token token` (Multiple Response Type) `none` (Multiple Response Type)
応答形式 (Response Modes)	1.1 ~	`query` (Multiple Response Type) `fragment` (Multiple Response Type) `form_post` (Form Post Response Mode)
応答形式 (Response Modes)	2.1 ~	`jwt` (JARM) `query.jwt` (JARM) `fragment.jwt` (JARM) `form_post.jwt` (JARM)
署名アルゴリズム	1.1 ~	`HS256` `HS384` `HS512` `RS256` `RS384` `RS512` `ES256` `ES384` `ES512` `PS256` `PS384` `PS512` `none`
署名アルゴリズム	2.2 ~	`Ed25519`
暗号アルゴリズム	1.1 ~	`RSA1_5` `RSA-OAEP` `RSA-OAEP-256` `A128KW` `A192KW` `A256KW` `dir` `ECDH-ES` `ECDH-ES+A128KW` `ECDH-ES+A192KW` `ECDH-ES+A256KW` `A128GCMKW` `A192GCMKW` `A1256GCMKW` `PBES2-HS256+A128KW` `PBES2-HS384+A192KW` `PBES2-HS512+A256KW`
	2.2 ~	`X25519`
暗号方式	1.1 ~	`A128CBC-HS256` `A192CBC-HS384` `A256CBC-HS512` `A128GCM` `A192GCM` `A256GCM`
Authlete 固有	1.1 ~	Client ID 別名 Extra Properties リフレッシュトークン再発行ポリシーサブジェクト毎の単一アクセストークンエラー説明の省略エラー URI の省略スコープ付与状態記憶機能 ^*1 PKCE 強制
	2.0 ~	スコープ属性 Mutual TLS 認証時の PKI 証明書チェーン検証 (RFC 8705)
	2.1 ~	コードチャレンジメソッド S256 強制 (PKCE) JWT 形式アクセストークン許容可能時刻差異 FAPI コンテキストにおけるバインディングメッセージ強制 (FAPI-CIBA) リフレッシュトークン再発行ポリシーの拡張
	2.2 ~	ID トークンのヘッダーへの独自クレーム追加 HSM (Hardware Security Module) サポートループバックリダイレクション URI の可変性 `offline_access` スコープ無しのリフレッシュで `openid` 削除
	2.3 ~	データベーステーブル分離冪等性リフレッシュトークン JWT アクセストークンへの任意クレーム追加外部アタッチメント用アクセストークン自動生成 (OIDC4IDA) サブジェクト毎の単一アクセストークン (クライアント単位の設定) PKCE 強制 (クライアント単位の設定) トークン交換機能の利用制限 (RFC 8693) JWT 認可グラントの利用制限 (RFC 7523)
トークン有効期間設定	1.1 ~	サービス毎のアクセストークン有効期間設定サービス毎のリフレッシュトークン有効期間設定サービス毎の ID トークン有効期間設定
	2.0 ~	スコープ毎のアクセストークン有効期間設定スコープ毎のリフレッシュトークン有効期間設定
	2.1 ~	クライアント毎のアクセストークン有効期間設定クライアント毎のリフレッシュトークン有効期間設定サービス毎のバックチャネル認証 ID 有効期間設定 (CIBA Core) サービス毎の認可レスポンス JWT 有効期間設定 (JARM) サービス毎の検証コード有効期間設定 (RFC 8628)
	2.2 ~	サービス毎のリクエスト URI 有効期間設定 (RFC 9126)

^{*1 : エンタープライズプランのみ}

OpenID Certification

OpenID 認証	バージョン	カテゴリー
OpenID Provider	1.1 ~	Basic OP Implicit OP Hybrid OP Config OP
OpenID Provider	2.1 ~	Dynamic OP Form Post OP
FAPI OpenID Provider	2.1 ~	Financial-grade API (FAPI) 1.0 Second Implementer’s Draft FAPI R/W OP w/ MTLS FAPI R/W OP w/ Private Key
	2.2 ~	Financial-grade API (FAPI) 1.0 Final FAPI Adv. OP w/ MTLS FAPI Adv. OP w/ MTLS, PAR FAPI Adv. OP w/ Private Key FAPI Adv. OP w/ Private Key, PAR FAPI Adv. OP w/ MTLS, JARM FAPI Adv. OP w/ Private Key, JARM FAPI Adv. OP w/ MTLS, PAR, JARM FAPI Adv. OP w/ Private Key, PAR, JARM UK Open Banking (Based on FAPI 1 Advanced Final) UK-OB Adv. OP w/ MTLS UK-OB Adv. OP w/ Private Key Australia CDR (Based on FAPI 1 Advanced Final) AU-CDR Adv. OP w/ Private Key AU-CDR Adv. OP w/ Private Key, PAR Brazil Open Banking (Based on FAPI 1 Advanced Final) BR-OB Adv. OP w/ MTLS BR-OB Adv. OP w/ Private Key BR-OB Adv. OP w/ MTLS, PAR BR-OB Adv. OP w/ Private Key, PAR BR-OB Adv. OP w/ MTLS, JARM BR-OB Adv. OP w/ Private Key, JARM BR-OB Adv. OP w/ MTLS, PAR, JARM BR-OB Adv. OP w/ Private Key, PAR, JARM BR-OB Adv. OP DCR Financial-grade API (FAPI) 1.0 Second Implementer’s Draft FAPI R/W OP w/ MTLS FAPI R/W OP w/ MTLS, PAR FAPI R/W OP w/ Private Key FAPI R/W OP w/ Private Key, PAR UK-OB R/W OP w/ MTLS UK-OB R/W OP w/ Private Key AU-CDR R/W OP w/ Private Key AU-CDR R/W OP w/ Private Key, PAR
	2.3 ~	Brazil Open Insurance (Based on FAPI 1 Advanced Final) BR-OPIN Adv. OP w/ MTLS BR-OPIN Adv. OP w/ Private Key BR-OPIN Adv. OP w/ MTLS, PAR BR-OPIN Adv. OP w/ Private Key, PAR BR-OPIN Adv. OP w/ MTLS, JARM BR-OPIN Adv. OP w/ Private Key, JARM BR-OPIN Adv. OP w/ MTLS, PAR, JARM BR-OPIN Adv. OP w/ Private Key, PAR, JARM BR-OPIN Adv. OP DCR KSA Open Banking (Based on FAPI 1 Advanced Final) KSA-OB Adv. OP w/ MTLS, PAR KSA-OB Adv. OP w/ Private Key, PAR
FAPI-CIBA Profile OpenID Provider	2.1 ~	FAPI-CIBA OP Poll w/ MTLS FAPI-CIBA OP Poll w/ Private Key FAPI-CIBA OP Ping w/ MTLS FAPI-CIBA OP Ping w/ Private Key
FAPI2 OpenID Provider	2.3 ~	FAPI 2.0 Security Profile Second Implementer’s Draft & Message Signing First Implementer’s Draft FAPI2SP MTLS + MTLS FAPI2SP private key + MTLS FAPI2SP OpenID Connect FAPI2MS JAR FAPI2MS JARM Australia FAPI 2.0 ConnectId Implementer’s Draft FAPI2MS with ConnectId support

Last Updated at November 29, 2022 by Authlete, Inc.

Spec Sheet

仕様

OpenID Certification