WIP

Author: cicnavi

docs/9-oidc-dcr-client-metadata.md

@@ -59,7 +59,7 @@ contract for what was honored.
 | `token_endpoint_auth_signing_alg` | Ignored | TBD | Relevant to `private_key_jwt` / `client_secret_jwt`. |
 | `default_max_age` | **Honored** (validate + store + echo + enforce) | Honored | Admin-editable. Default applied when max_age omitted (MaxAgeRule). |
 | `require_auth_time` | **Honored** (validate + store + echo + enforce) | Honored | Admin-editable. Forces auth_time into the ID Token (MaxAgeRule -> AuthCodeGrant). |
-| `default_acr_values` | **Honored** (validate + store + echo + enforce) | Honored | Admin-editable. Default applied when acr_values omitted (AcrValuesRule). |
+| `default_acr_values` | **Honored** (validate + store + echo + enforce) | Honored | Constrained to `acr_values_supported`: DCR rejects unsupported values; the admin field is a multi-select of the supported ACRs. Default applied when acr_values omitted (AcrValuesRule). |
 | `initiate_login_uri` | **Validated + echoed** | Validated + echoed | Admin-editable; https URI. Informational. |
 | `backchannel_logout_session_required` | Ignored | TBD | |
 | `frontchannel_logout_uri` / `..._session_required` | **Reject** if requested | Reject | Front-channel logout not supported. |

src/Forms/ClientForm.php

@@ -418,9 +418,10 @@ public function getValues(string|object|bool|null $returnType = null, ?array $co
         $values[ClaimsEnum::RequireAuthTime->value] = (bool)($values[ClaimsEnum::RequireAuthTime->value] ?? false);
 
         /** @var mixed $defaultAcrValues */
-        $defaultAcrValues = $values[ClaimsEnum::DefaultAcrValues->value] ?? '';
-        $values[ClaimsEnum::DefaultAcrValues->value] = $this->helpers->str()->convertTextToArray(
-            is_string($defaultAcrValues) ? $defaultAcrValues : '',
+        $defaultAcrValues = $values[ClaimsEnum::DefaultAcrValues->value] ?? null;
+        $defaultAcrValues = is_array($defaultAcrValues) ? $defaultAcrValues : [];
+        $values[ClaimsEnum::DefaultAcrValues->value] = array_values(
+            array_intersect($defaultAcrValues, array_keys($this->getSupportedAcrValues())),
         );
 
         foreach (
@@ -569,14 +570,11 @@ public function setDefaults(object|array $values, bool $erase = false): static
         /** @var mixed $defaultAcrValues */
         $defaultAcrValues = $values[ClaimsEnum::DefaultAcrValues->value] ?? null;
         $defaultAcrValues = is_array($defaultAcrValues) ? $defaultAcrValues : [];
-        $defaultAcrStrings = [];
-        /** @var mixed $acr */
-        foreach ($defaultAcrValues as $acr) {
-            if (is_string($acr)) {
-                $defaultAcrStrings[] = $acr;
-            }
-        }
-        $values[ClaimsEnum::DefaultAcrValues->value] = implode("\n", $defaultAcrStrings);
+        // The field is a multi-select bound to the OP's supported ACRs; keep only currently-supported values so the
+        // control can render them (values no longer supported are dropped rather than shown as invalid options).
+        $values[ClaimsEnum::DefaultAcrValues->value] = array_values(
+            array_intersect($defaultAcrValues, array_keys($this->getSupportedAcrValues())),
+        );
 
         /** @var mixed $contacts */
         $contacts = $values[ClaimsEnum::Contacts->value] ?? null;
@@ -729,10 +727,12 @@ protected function buildForm(): void
 
         $this->addCheckbox(ClaimsEnum::RequireAuthTime->value, Translate::noop('Require auth_time in ID Token'));
 
-        $this->addTextArea(
+        // Bound to the OP's supported ACRs (acr_values_supported). When the OP advertises no ACRs, this has no
+        // items and the field is hidden in the template (a per-client default ACR cannot do anything in that case).
+        $this->addMultiSelect(
             ClaimsEnum::DefaultAcrValues->value,
-            Translate::noop('Default ACR Values (one per line)'),
-            null,
+            Translate::noop('Default ACR Values'),
+            $this->getSupportedAcrValues(),
             3,
         )->setHtmlAttribute('class', 'full-width');
 
@@ -865,6 +865,28 @@ protected function getSupportedTokenEndpointAuthMethods(): array
         return array_combine($supported, $supported);
     }
 
+    /**
+     * The OP's supported ACR values (value => label), as configured via OPTION_AUTH_ACR_VALUES_SUPPORTED and
+     * advertised in discovery as acr_values_supported. Empty when the OP advertises no ACRs.
+     *
+     * @return array<string,string>
+     */
+    protected function getSupportedAcrValues(): array
+    {
+        $supported = array_values(array_filter($this->moduleConfig->getAcrValuesSupported(), 'is_string'));
+
+        return array_combine($supported, $supported);
+    }
+
+    /**
+     * Whether the OP has any supported ACR values configured. Used by the template to hide the per-client
+     * default_acr_values field when there is nothing to select.
+     */
+    public function hasConfiguredAcrValues(): bool
+    {
+        return $this->getSupportedAcrValues() !== [];
+    }
+
     /**
      * Application types the client may register (value => label).
      *

src/Server/Registration/ClientMetadataValidator.php

@@ -294,13 +294,21 @@ private function validateAdditionalMetadata(array $metadata): void
             if (!is_array($defaultAcrValues)) {
                 throw OidcServerException::invalidClientMetadata('default_acr_values must be an array.');
             }
+            $supportedAcrValues = $this->moduleConfig->getAcrValuesSupported();
             /** @var mixed $acr */
             foreach ($defaultAcrValues as $acr) {
                 if (!is_string($acr) || $acr === '') {
                     throw OidcServerException::invalidClientMetadata(
                         'default_acr_values must be an array of non-empty strings.',
                     );
                 }
+                // Reject ACRs the OP does not support (advertised in discovery as acr_values_supported); requesting
+                // an unsupported ACR could never be satisfied at the authorization endpoint.
+                if (!in_array($acr, $supportedAcrValues, true)) {
+                    throw OidcServerException::invalidClientMetadata(
+                        sprintf('default_acr_values contains an unsupported ACR value: "%s".', $acr),
+                    );
+                }
             }
         }
 

templates/clients/includes/form.twig

@@ -210,14 +210,16 @@
             {% trans %}When enabled, the auth_time claim is always included in ID Tokens issued to this Client.{% endtrans %}
         </span>
 
+        {% if form.hasConfiguredAcrValues() %}
         <label for="frm-default_acr_values">{{ 'Default ACR Values'|trans }}</label>
         {{ form.default_acr_values.control | raw }}
         <span class="pure-form-message">
-            {% trans %}Default requested Authentication Context Class Reference values, applied when the authorization request omits acr_values. One per line.{% endtrans %}
+            {% trans %}Default requested Authentication Context Class Reference values, applied when the authorization request omits acr_values. Selected from the ACRs supported by this OP.{% endtrans %}
         </span>
         {% if form.default_acr_values.hasErrors %}
             <span class="pure-form-message red-text">{{ form.default_acr_values.getError }}</span>
         {% endif %}
+        {% endif %}
 
         <label for="frm-initiate_login_uri">{{ 'Initiate Login URI'|trans }}</label>
         {{ form.initiate_login_uri.control | raw }}

tests/unit/src/Forms/ClientFormTest.php

@@ -47,6 +47,8 @@ public function setUp(): void
         $this->csrfProtectionMock =  $this->createMock(CsrfProtection::class);
         $this->moduleConfigMock = $this->createMock(ModuleConfig::class);
         $this->moduleConfigMock->method('getSupportedResponseModes')->willReturn(['query', 'fragment', 'form_post']);
+        $this->moduleConfigMock->method('getAcrValuesSupported')
+            ->willReturn(['urn:mace:incommon:iap:silver', 'urn:mace:incommon:iap:bronze']);
 
         $signatureKeyPairBagMock = $this->createMock(SignatureKeyPairBag::class);
         $signatureKeyPairBagMock->method('getAllAlgorithmNamesUnique')->willReturn(['RS256', 'ES256']);
@@ -249,6 +251,24 @@ public function testEmptyTokenEndpointAuthMethodNormalizesToNull(): void
         $this->assertSame([], $values[ClaimsEnum::ResponseTypes->value]);
     }
 
+    public function testDefaultAcrValuesAreConstrainedToSupported(): void
+    {
+        // The field is a multi-select bound to the OP's supported ACRs. setDefaults (the edit path) drops values
+        // that are no longer supported, so the control never receives an out-of-range value.
+        $data = array_merge($this->clientDataSample, [
+            ClaimsEnum::DefaultAcrValues->value => [
+                'urn:mace:incommon:iap:silver',
+                'urn:not:supported',
+            ],
+        ]);
+        $sut = $this->sut()->setDefaults($data);
+
+        $values = $sut->getValues();
+
+        $this->assertSame(['urn:mace:incommon:iap:silver'], $values[ClaimsEnum::DefaultAcrValues->value]);
+        $this->assertTrue($sut->hasConfiguredAcrValues());
+    }
+
     public function testInformationalMetadataRoundTrip(): void
     {
         $sut = $this->sut();

tests/unit/src/Server/Registration/ClientMetadataValidatorTest.php

@@ -21,6 +21,8 @@ protected function setUp(): void
         $this->moduleConfigMock = $this->createMock(ModuleConfig::class);
         // Default: impersonation protection on.
         $this->moduleConfigMock->method('getDcrImpersonationProtectionEnabled')->willReturn(true);
+        // Default: the OP advertises a single supported ACR.
+        $this->moduleConfigMock->method('getAcrValuesSupported')->willReturn(['urn:mace:incommon:iap:silver']);
     }
 
     protected function sut(): ClientMetadataValidator
@@ -223,6 +225,18 @@ public function testNonArrayDefaultAcrValuesIsRejected(): void
         );
     }
 
+    public function testUnsupportedDefaultAcrValueIsRejected(): void
+    {
+        $this->assertRejected(
+            [
+                'redirect_uris' => ['https://client.example.org/cb'],
+                'default_acr_values' => ['urn:mace:incommon:iap:silver', 'urn:not:supported'],
+            ],
+            'invalid_client_metadata',
+            'default_acr_values',
+        );
+    }
+
     public function testNonHttpsInitiateLoginUriIsRejected(): void
     {
         $this->assertRejected(