The FAPI working group, which has taken the important job of developing a high-security OAuth 2.0 profile for financial applications (as in Open Banking), has come up with a new specification, called JARM, for signed and optionally encrypted authorisation responses. The response parameters, such as authorisation code and state for the code flow, are relayed as a JSON Web Token (JWT) payload, enhancing the response with the security properties of authenticating the issuer, restricting the audience to the client ID as well as protecting from replay, credential leaks and mix-up attacks.
JARM stands for JWT Secured Authorization Response Mode.
The JARM spec defines a new response mode where the parameters are packaged into a JWT that is signed by the Authorisation Server. That also covers error responses and OpenID authentication responses.
In JARM, the response parameters are packaged into a JWT, which includes the additional mandatory claims issuer (iss), audience (aud) and expiration time (exp) claims to ensure the JWT has a clearly identified origin and destination (the client_id), and a limited lifespan.
The JWT is signed or HMAC-protected, and can be additionally encrypted for confidentiality.
How does an Authorisation Server / OpenID Provider advertise support for JARM?
response_modes_supported -- Must include query.jwt, fragment.jwt, form_post.jwt and / or jwt (shortcut response mode for the more specific ones).
authorization_signing_alg_values_supported -- The supported JWS algorithms for JARM. The none algorithm, i.e. a plain JWT is forbidden.
authorization_encryption_alg_values_supported -- The supported JWE algorithms (if encryption is supported).
authorization_encryption_enc_values_supported -- The supported JWE methods (if encryption is supported).
To resolve the metadata for an OpenID provider use the extending OIDCProviderMetadata class instead.
How to register an OAuth 2.0 client for JARM?
Simply set the authorization_signed_response_alg client metadata to the desired JWS algorithm (which the OAuth 2.0 server must support) to have the responses signed.
The method is identical if you're registering an OpenID relying party, just use the extending OIDCClientMetadata class instead.
How to make an OAuth 2.0 authorisation request for JARM?
Set the optional response_mode parameter to the specific JARM mode, e.g. query.jwt or the jwt shortcut. If the Authorisation Server has the client registered for JARM an explicit request for JARM may not be needed.
For an OpenID authentication request use the AuthenticationRequest class instead.
How to parse and validate a JARM response?
Create a JARM validator for the expected Authorisation Server issuer URI, client ID and JWS algorithm, and provide it with a source for the signing keys.
Support for JARM was added in version 6.3 of this SDK.