Add subject_uri_schemes_supported property to AS Metadata

[acoburn]

Resolves #151

This defines a new property for the authorization server metadata document: subject_uri_schemes_supported. This uses uri rather than url, since all other IANA-registered OAuth Parameters use URI rather than URL.

Inclusion of the new property is set at SHOULD level. If omitted, the default value is ["https"]

---

Preview | Diff

[elf-pavlik]

@acoburn could you explain shortly your thinking behind SHOULD instead of MUST and the default https? My general preference is to keep as much as possible explicit, I mostly want to understand motivation for the proposed approach.

[acoburn]

@elf-pavlik

Each of the authentication suites defines a validation section with text along the lines of

For an ID Token to validate as an LWS authentication credential, there must be a trust relationship between the verifier and the issuing party.

In the absence of a pre-existing trust relationship, the validator MUST dereference the sub (subject) claim in the authentication credential. The resulting resource MUST be formatted as a valid controlled identifier document [CID-1.0] with an id value equal to the subject identifier.

In other words, the AS either has a pre-existing trust relationship with the issuer (common in enterprise federations) or it doesn't (common in an open ecosystem deployment). Dereferencing the subject URI is therefore only necessary in the second case, meaning that there are entire categories of deployments in which the subject_uri_schemes_supported metadata is not relevant. That is why the property is optional.

In RFC 8414, many of the optional properties have defaults, and there seemed to be general support for making that default "https".