Client policies: executor for validate and match a redirect URI

closes keycloak#25637 Signed-off-by: Takashi Norimatsu <[email protected]>
tnorimat · Feb 17, 2024 · 6048e21 · 6048e21
1 parent 1f57fc1
commit 6048e21
Show file tree

Hide file tree

Showing 7 changed files with 2,000 additions and 1 deletion.
diff --git a/docs/documentation/server_admin/topics/clients/client-policies.adoc b/docs/documentation/server_admin/topics/clients/client-policies.adoc
@@ -131,6 +131,7 @@ One of several purposes for this executor is to realize the security requirement
 * Enforce <<_dpop-bound-tokens,DPoP-binding tokens>> is used (available when `dpop` feature is enabled)
 * Enforce <<_using_lightweight_access_token, using lightweight access token>>
 * Enforce that <<_refresh_token_rotation,refresh token rotation>> is skipped and there is no refresh token returned from the refresh token response
+* Enforce a valid redirect URI that the OAuth 2.1 specification requires
 
 [[_client_policy_profile]]
 === Profile