Flags Supported in Authlete

Overview

Over the years, Authlete has implemented a large number of standard specifications. Among them, there have been several occasions where changes to Authlete’s implementation were necessary due to overlooked details, misinterpretations, or breaking changes in the specifications themselves. This article shares various flags created from these challenges. Service flags in Authlete provide essential configuration flexibility that allows developers to fine-tune the behavior of their OAuth 2.0 and OpenID Connect implementations. These boolean switches and configuration parameters enable organizations to balance strict specification compliance with practical deployment considerations. Service flags serve multiple crucial purposes:

Allow gradual migration to stricter compliance requirements without breaking existing integrations
Provide options for handling edge cases or ambiguities in the specifications
Enable customization of security policies to meet specific organizational requirements
Facilitate interoperability with a wide range of client applications, including those that may not fully comply with the latest standards

Flags for Specification Compliance

The table below shows an overview of the Authlete service flags:

Flag	Type	Description	Default Value
Service.missingClientIdAllowed	Boolean	When set to `true` or `enabled` in the console, the client is identified from the authorization code when the `client_id` request parameter is missing.	False
Service.claimShortcutRestrictive	Boolean	Ensures strict adherence to the OpenID Connect specification regarding claim embedding. When set to `true` or enabled in the console, it ensures that claims requested by the profile, email, address, and phone scope values are only included in the ID Token if no Access Token is issued.	True
Service.dcrDuplicateSoftwareIdBlocked	Boolean	When set to `True`, Authlete rejects dynamic client registration requests containing a registered `software_id`	False
Service.dcrScopeUsedAsRequestable	Boolean	Limits the range of scopes that the client application can request. When set to `True`, follows RFC 7591 standard by treating scopes specified during dynamic client registration as requestable scopes.	False
Service.frontChannelRequestObjectEncryptionRequired	Boolean	When sending a request object via the front channel, it must be encrypted.	False
Service.idTokenAudType	Array, String, or Null	Addresses the JWT specification flexibility where the `aud` claim can be either an `array` or a `single string`, causing inconsistency in how receiving systems must process tokens. It can also be overridden at runtime using the `idTokenAudType` parameter in Authlete APIs that issue ID tokens (such as `/auth/authorization/issue`).	Null
Service.idTokenReissuable	Boolean	controls whether the `/auth/token` API returns `ID_TOKEN_REISSUABLE`. When set to `True`, the /`auth/token` API returns `"action": "ID_TOKEN_REISSUABLE"` if the conditions are all met.	False
Service.issSuppressed	Boolean	When set to `True`, does not include iss response parameter in the authorization response.	False
Service.loopbackRedirectionUriVariable	Boolean	Controls how the authorization server handles port numbers in loopback IP address redirection URIs during OAuth 2.0 flows. When set to `True`, Treats the port number as variable when the host part of the redirection URI is a loopback IP address, following RFC 8252 Section 7.3	False
Service.nbfOptional	Boolean	When set to `True`, the authorization server does not enforce the request object lifespan check, even in scenarios where FAPI 1.0 Part 2 compliance would normally require it. In other words, the `nbf` claim is treated as optional rather than mandatory.	False
Service.refreshTokenIdempotent	Boolean	When set to `True` or enabled in the console, ensures consistent results for duplicate token refresh requests within a 60-second window, preventing issues when the same refresh token is used multiple times.	False
Service.refreshTokenKept	Boolean	Controls the behavior of refresh token rotation. When set to `True`, refresh token rotation will not occur.	True
Service.requestObjectEncryptionAlgMatchRequired	Boolean	The algorithm specified in the alg parameter of the encrypted request object must be a specific value.	False
Service.requestObjectEncryptionEncMatchRequired	Boolean	The algorithm specified in the `enc` parameter of the encrypted request object must be a specific value.	False
Service.scopeRequired	Boolean	Controls how authorization requests without a scope parameter are handled. When set to `True`, Authorization requests without a scope parameter will either use configured default scopes or be rejected with an invalid scope error if no defaults exist.	False
Service.traditionalRequestObjectProcessingApplied	Boolean	Allows switching between processing request objects using the OIDC Core method (for backward compatibility) or the RFC 9101 method.	False
Service.unauthorizedOnClientConfigSupported	Boolean	When this flag is set to true, Authlete will return UNAUTHORIZED where applicable. When false, for backward compatibility, Authlete will return `BAD_REQUEST` instead (even though this does not strictly follow RFC 7592).	False

Configure Flags in the Management Console

Starting with Authlete 3.0, flags have been introduced in the management console to enforce strict requirements to meet OAuth/OIDC specifications. The following sections demonstrate configuring service setting flags in the Authlete Management Console:

Client ID Omission

To Configure the Service.missingClientIdAllowed flag in the management console:

Navigate to **Service Settings > Endpoints > Token > General **
To enable the flag, toggle the “Client ID Omission" option.
Click Save Changes to apply the updates.

Client ID Omission

Restrict Shortcut

To Configure the Service.claimShortcutRestrictive flag in the management console:

Navigate to Service Settings > Tokens and Claims > Claims > Supported Claims
To turn on, toggle the “Restrict Shortcut” option.
Click Save Changes to apply the updates.

Restrict Shortcut

DCR with Duplicate Software ID

To Configure the Service.dcrDuplicateSoftwareIdBlocked flag in the management console:

Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration **
Go to“DCR with Duplicate Software ID” and toggle the Accept option.
Click Save Changes to apply the updates.

DCR with Duplicate Software ID

DCR’s Scope Parameter

To Configure the Service.dcrScopeUsedAsRequestable flag in the management console:

Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration **
Go to "DCR's Scope Parameter" and toggle the Enable option.
Click Save Changes to apply the updates.

DCR’s Scope Parameter

Encryption in Front Channel

To Configure the Service.frontChannelRequestObjectEncryptionRequired flag in the management console:

Navigate to Service Settings > Endpoints > Authorization > Request Object
Go to "Encryption in Front Channel" and toggle the Require option.
Click Save Changes to apply the updates.

Encryption in Front Channel

Choose Audience Claim Format

To Configure the Service.idTokenAudType flag in the management console:

Navigate to Service Settings > Tokens and Claims > ID Token
Open the “Choose Audience Claim Format” menu and select an option.
Click Save Changes to apply the updates.

Choose Audience Claim Format

Enable Reissuable

To Configure the Service.idTokenReissuable flag in the management console:

Navigate to Service Settings > Tokens and Claims > ID Token
Under ID Tokens section, toggle the "Enable Reissuable” option.
Click Save Changes to apply the updates.

Enable Reissuable

Issuer Identification Response Parameter

To Configure the Service.issSuppressed flag in the management console:

Navigate to Service Settings > Endpoints > Authorization
Under "Issuer Identification Response Parameter", toggle the Suppress iss Response Parameter option.
Click Save Changes to apply the updates.

Issuer Identification Response Parameter

Loopback Redirection URI

To configure the Service.loopbackRedirectionUriVariable flag in the management console:

Navigate to Service Settings > Endpoints > Authorization > General
Go to "Loopback Redirection URI" and toggle the Loopback Redirection URI option.
Click Save Changes to apply the updates.

Loopback Redirection URI

nbf claim

To configure the Service.nbfOptional flag in the management console:

Navigate to **Service Settings > Endpoints > Authorization > Request Object **
Go to "nbf claim"" and toggle the "Require" option.
Click Save Changes to apply the updates.

nbf claim

Enable Idempotency

To configure the Service.refreshTokenIdempotent flag in the management console:

Navigate to **Service Settings > Tokens and Claims > Refresh Tokens > General **
Under Refresh Token Rotation, toggle the Enable Idempotency option.
Click Save Changes to apply the updates.

Enable Idempotency

Enable Token Rotation

To configure the Service.refreshTokenKept flag in the management console:

Navigate to **Service Settings > Token and Claims > Refresh Tokens **
Under Refresh Token Rotation, toggle the "Enable Token Rotation" option. By default Enable Token Rotation is enabled.
Click Save Changes to apply the updates.

Enable Token Rotation

Encryption Algorithm Match

To configure the Service.requestObjectEncryptionAlgMatchRequired flag in the management console:

Navigate to **Service Settings > Endpoints > Authorization > Request Object **
Go to the "Encryption Algorithm Match" option, toggle Require.
Click Save Changes to apply the updates.

Encryption Algorithm Match

Encryption Encoding Algorithm Match

To configure the Service.requestObjectEncryptionEncMatchRequired flag in the management console:

Navigate to **Service Settings > Endpoints > Authorization > Request Object **
Go to the "Encryption Encoding Algorithm Match" and toggle Require.
Click Save Changes to apply the updates.

Encryption Encoding Algorithm Match

Requests Without Scope Parameter

To configure the Service.scopeRequired flag in the management console:

Navigate to **Service Settings > Tokens and Claims > Advanced > Scopes **
Go to "Requests Without Scope Parameter" and toggle Reject.
Click Save Changes to apply the updates.

Requests Without Scope Parameter

Request Object Processing

To configure the Service.traditionalRequestObjectProcessingApplied flag in the management console:

Navigate to **Service Settings > Endpoints > Authorization > Request Object **
Go to "Request Object Processing" and toggle the Enable JAR Compatibility option.
Click Save Changes to apply the updates.

Request Object Processing

Return UNAUTHORIZED

To configure the Service.unauthorizedOnClientConfigSupported flag in the management console:

Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration **
Go to "Client Configuration Error Behavior" option and toggle Return UNAUTHORIZED.
Click Save Changes to apply the updates.

Return UNAUTHORIZED

Example Request

Service Configurations for Service.setUnauthorizedOnClientConfigSupported flag. The following example uses a POST request /api/{serviceId}/service/update.

Authlete API Request that shows how to update the unauthorizedOnClientConfigSupported flag to true.

curl -v -X POST "https://us.authlete.com/api/${SERVICE_API_KEY}/service/update" \
  -H 'Content-Type:application/json' \
  -H "Authorization: Bearer ${SERVICE_ACCESS_TOKEN}" \
  -d '{
    "unauthorizedOnClientConfigSupported": true
  }'

リクエストを実行する前に、以下を設定してください。

${SERVICE_API_KEY} — サービス ID
${SERVICE_ACCESS_TOKEN} — コンソールで発行したサービスアクセストークン
API クラスターのホスト名 — us、jp、eu、br のいずれか

エンドポイント

トークン & クレーム

鍵管理

メタデータ

エラー処理とデバッグ

セキュリティ

クライアント管理

サービス設定

Overview

Flags for Specification Compliance