{"action":"closed","issue":{"url":"https://api.github.com/repos/openid-certification/oidctest/issues/34","repository_url":"https://api.github.com/repos/openid-certification/oidctest","labels_url":"https://api.github.com/repos/openid-certification/oidctest/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/openid-certification/oidctest/issues/34/comments","events_url":"https://api.github.com/repos/openid-certification/oidctest/issues/34/events","html_url":"https://github.com/openid-certification/oidctest/issues/34","id":240486054,"number":34,"title":"missing iss and aud claims in signed Request Objects","user":{"login":"panva","id":241506,"avatar_url":"https://avatars0.githubusercontent.com/u/241506?v=3","gravatar_id":"","url":"https://api.github.com/users/panva","html_url":"https://github.com/panva","followers_url":"https://api.github.com/users/panva/followers","following_url":"https://api.github.com/users/panva/following{/other_user}","gists_url":"https://api.github.com/users/panva/gists{/gist_id}","starred_url":"https://api.github.com/users/panva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/panva/subscriptions","organizations_url":"https://api.github.com/users/panva/orgs","repos_url":"https://api.github.com/users/panva/repos","events_url":"https://api.github.com/users/panva/events{/privacy}","received_events_url":"https://api.github.com/users/panva/received_events","type":"User","site_admin":false},"labels":[{"id":583053840,"url":"https://api.github.com/repos/openid-certification/oidctest/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"closed","locked":false,"assignee":{"login":"rohe","id":99900,"avatar_url":"https://avatars2.githubusercontent.com/u/99900?v=3","gravatar_id":"","url":"https://api.github.com/users/rohe","html_url":"https://github.com/rohe","followers_url":"https://api.github.com/users/rohe/followers","following_url":"https://api.github.com/users/rohe/following{/other_user}","gists_url":"https://api.github.com/users/rohe/gists{/gist_id}","starred_url":"https://api.github.com/users/rohe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rohe/subscriptions","organizations_url":"https://api.github.com/users/rohe/orgs","repos_url":"https://api.github.com/users/rohe/repos","events_url":"https://api.github.com/users/rohe/events{/privacy}","received_events_url":"https://api.github.com/users/rohe/received_events","type":"User","site_admin":false},"assignees":[{"login":"rohe","id":99900,"avatar_url":"https://avatars2.githubusercontent.com/u/99900?v=3","gravatar_id":"","url":"https://api.github.com/users/rohe","html_url":"https://github.com/rohe","followers_url":"https://api.github.com/users/rohe/followers","following_url":"https://api.github.com/users/rohe/following{/other_user}","gists_url":"https://api.github.com/users/rohe/gists{/gist_id}","starred_url":"https://api.github.com/users/rohe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rohe/subscriptions","organizations_url":"https://api.github.com/users/rohe/orgs","repos_url":"https://api.github.com/users/rohe/repos","events_url":"https://api.github.com/users/rohe/events{/privacy}","received_events_url":"https://api.github.com/users/rohe/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2017-07-04T19:22:30Z","updated_at":"2017-07-04T20:40:26Z","closed_at":"2017-07-04T20:40:26Z","body":"every OP test that includes sending a request object (either by reference or value) should have two extra claims in the request object it sends (or references by sending request_uri)\r\n\r\n- `iss` with the value being the client id\r\n- and `aud` being the OP's issuer identifier\r\n\r\nFrom Core 1.0\r\n> If signed, the Request Object SHOULD contain the Claims iss (issuer) and aud (audience) as members. The iss value SHOULD be the Client ID of the RP, unless it was signed by a different party than the RP. The aud value SHOULD be or include the OP's Issuer Identifier URL.\r\n\r\nNow i added these SHOULD validations to my OP and tests don't pass anymore. If the OP tool were including them both OPs with and without this validation would be passing."}}
{"actor":{"display_login":"panva"}}