DPoP proof requirement

Requires a valid DPoP proof at /token, for clients that registered for sender-constrained tokens and for any client the operator names.

• Control id: dpop
• Shape: floor. An OR across the own row and every matching binding.
• Entry points: token

Policy data

pbac.operator.controls.dpop

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-dpop.v1.json

Setting	Type	Default
require_dpop	boolean	none in the schema
require_dpop_for_clients	array of string	none in the schema

Reads

• dpop.present
• dpop.valid
• context.client.client_id
• context.client.dpop_bound_access_tokens

Emits

• deny
• reason

Reason codes

Code	Category	Entry point	Setting
dpop_proof_required	control	token	pbac.operator.controls.dpop#require_dpop

Implementation

Kind	Reference	Files	Role
rego_package	oauth.dpop	opa/policies/oauth/dpop.rego	decides
java	com.identos.pbac.oauth.service.DPopProofValidator	src/main/java/com/identos/pbac/oauth/service/DPopProofValidator.java	computes_fact
java	com.identos.pbac.oauth.config.DPopFilter	src/main/java/com/identos/pbac/oauth/config/DPopFilter.java	computes_fact