Implement SEP-991: URL-based Client Registration (OAuth Client ID Metadata)

[felixweinberger]

This is a tracking issue for implementation of SEP-991.

Summary

This SEP adopts OAuth Client ID Metadata Documents as an alternative client registration mechanism, allowing clients to use HTTPS URLs as client identifiers where the URL points to a JSON document containing client metadata. The Rust SDK needs to implement support for accepting HTTPS URLs as client_id values, fetching and validating client metadata documents from those URLs, and enabling servers to implement flexible trust policies for URL-based client registration without requiring pre-coordination.

Related Issues & PRs

• Implementation PRs: n/a
• Related PRs: n/a
• Related Issues: n/a

[tanish111]

@alexhancock can I take this one?

[alexhancock]

Yeah absolutely. I haven't seen any work on CIMD yet for the rust sdk.

[tanish111]

@alexhancock I have raised an PR for this #570 can you look into it.
It took me a while to complete this, as there is limited documentation and very few reference implementations available online for this protocol.

[jokemanfire]

I think the functionality is basically completed, and the remaining security issues will be addressed in a unified manner in the future.

[tanish111]

While implementing this, a major challenge was testing the protocol, as it required a CIMD-supported authorization server (which are not yet widely available) to validate client behavior. To address this, I developed a local OAuth authorization server specifically for testing purposes. This implementation is accepted in the official OAuth documentation under Client ID Metadata Document and is listed among the reference implementations as Local Authorization Server for Testing.

[tanish111]

@alexhancock I think we can close this issue?

[alexhancock]

Yes, agree. Great!