V51 OAuth: Add new OIDC Authorization Server verifications

[TobiasAhnoff]

The following verifications are suggested to be added to the proposed new OIDC chapter (see #2037).

Authorization Server

Verify that well known industry standard Authorization Servers are used, preferably these services are certified and listed at https://openid.net/certification/#OPENID-OP-P. For L3 applications they should also be implement the FAPI security profile.

Verify that only the grant types 'code', 'ciba' or 'id-token' are used. Note that FAPI 2.0 recommends 'code' over the OIDC Hybrid flow 'id-token code' (which was previously recommended in FAPI 1.0).

Verify that all clients requiring access tokens are using the 'code' grant or, if needed for device flows, the 'ciba' grant.

[randomstuff]

Verify that only the grant types 'code', 'ciba' or 'id-token' are used. Note that FAPI 2.0 recommends 'code' over the OIDC Hybrid flow 'id-token code' (which was previously recommended in FAPI 1.0).

I believe the wording is somewhat misleading: there is no grant_type=id_token but response_mode=id_token / code id_token.

[elarlang]

Verify that well known industry standard Authorization Servers are used, preferably these services are certified and listed at https://openid.net/certification/#OPENID-OP-P. For L3 applications they should also be implement the FAPI security profile.

For me it feels that we have it covered with dependency requirements in V14.2 Dependency. I think ASVS should concentrate on vulnerabilities not on certificates, although there can be correlation.

Verify that only the grant types 'code', 'ciba' or 'id-token' are used. Note that FAPI 2.0 recommends 'code' over the OIDC Hybrid flow 'id-token code' (which was previously recommended in FAPI 1.0).

Is the wording updated based on feedback?

Verify that all clients requiring access tokens are using the 'code' grant or, if needed for device flows, the 'ciba' grant.

todo: is it covered somewhere else?