Appendix A. JSON Schema for MATF Metadata
Questa sezione conserva il testo RFC per MATF, inclusi federation trust model, metadata repository, public key pinning, JSON/JWS metadata, usage scenarios, deployments, security considerations e JSON Schema.
Appendix A. JSON Schema for MATF Metadata
The following JSON Schema defines the structure of MATF metadata. It
conforms to draft 2020-12 of the JSON Schema standard.
Version: 1.0.0
=============== NOTE: '\\' line wrapping per RFC 8792 ===============
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://mtlsfed.se/schema/matf-metadata-schema.json",
"title": "JSON Schema for Mutually Authenticating TLS in the con\
\text of Federations",
"description": "Version: 1.0.0",
"type": "object",
"additionalProperties": true,
"required": [
"iat",
"exp",
"iss",
"version",
"entities"
],
"properties": {
"iat": {
"title": "Issued at",
"description": "Time at which the metadata was issued (U\
\NIX timestamp)",
"type": "integer",
"minimum": 0,
"examples": [
1755514949
]
},
"exp": {
"title": "Expiration time",
"description": "Time at which the metadata expires (UNIX\
\ timestamp)",
"type": "integer",
"minimum": 0,
"examples": [
1756119888
]
},
"iss": {
"title": "The federation issuing the metadata",
"description": "A URI that uniquely identifies the feder\
\ation that issued the metadata",
"type": "string",
"format": "uri",
"minLength": 1,
"examples": [
"https://example.com/federation"
]
},
"version": {
"title": "Metadata schema version",
"description": "Schema version follows semantic versioni\
\ng (https://semver.org)",
"type": "string",
"pattern": "^\\d+\\.\\d+\\.\\d+$",
"examples": [
"1.0.0"
]
},
"cache_ttl": {
"title": "Metadata cache TTL",
"description": "How long in seconds to cache metadata. T\
\he effective maximum is bounded by the exp claim.",
"type": "integer",
"minimum": 0,
"examples": [
3600
]
},
"entities": {
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/$defs/entity"
}
}
},
"$defs": {
"entity": {
"type": "object",
"additionalProperties": true,
"required": [
"entity_id",
"issuers"
],
"properties": {
"entity_id": {
"title": "Entity identifier",
"description": "Globally unique identifier for t\
\he entity.",
"type": "string",
"format": "uri",
"examples": [
"https://example.com"
]
},
"organization": {
"title": "Name of entity organization",
"description": "Name identifying the organizatio\
\n that the entity's metadata represents.",
"type": "string",
"examples": [
"Example Org"
]
},
"issuers": {
"title": "Entity certificate issuers",
"description": "A list of certificate issuers th\
\at are allowed to issue certificates for the entity's endpoints. Fo\
\r each issuer, the issuer's root CA certificate is included in the \
\x509certificate property (PEM-encoded).",
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/$defs/cert_issuers"
}
},
"servers": {
"type": "array",
"items": {
"$ref": "#/$defs/endpoint"
}
},
"clients": {
"type": "array",
"items": {
"$ref": "#/$defs/endpoint"
}
}
}
},
"endpoint": {
"type": "object",
"additionalProperties": true,
"required": [
"pins"
],
"properties": {
"description": {
"title": "Endpoint description",
"type": "string",
"examples": [
"SCIM Server 1"
]
},
"tags": {
"title": "Endpoint tags",
"description": "A list of strings that describe \
\the endpoint's capabilities.",
"type": "array",
"items": {
"type": "string",
"pattern": "^[a-z0-9]{1,64}$",
"examples": [
"xyzzy"
]
}
},
"base_uri": {
"title": "Endpoint base URI",
"type": "string",
"format": "uri",
"examples": [
"https://scim.example.com"
]
},
"pins": {
"title": "Certificate pin set",
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/$defs/pin_directive"
}
}
}
},
"cert_issuers": {
"title": "Certificate issuers",
"type": "object",
"additionalProperties": false,
"required": [
"x509certificate"
],
"properties": {
"x509certificate": {
"title": "X.509 Certificate (PEM)",
"type": "string",
"pattern": "^-----BEGIN CERTIFICATE-----(?:\\r?\\
\\n)(?:[A-Za-z0-9+/=]{64}\\r?\\n)*(?:[A-Za-z0-9+/=]{1,64}\\r?\\n)---\
\--END CERTIFICATE-----(?:\\r?\\n)?$"
}
}
},
"pin_directive": {
"title": "RFC 7469 pin directive",
"type": "object",
"additionalProperties": false,
"required": [
"alg",
"digest"
],
"properties": {
"alg": {
"title": "Directive name",
"type": "string",
"enum": [
"sha256"
],
"examples": [
"sha256"
]
},
"digest": {
"title": "Directive value (Base64)",
"type": "string",
"pattern": "^[A-Za-z0-9+/]{43}=$",
"examples": [
"HiMkrb4phPSP+OvGqmZd6sGvy7AUn4k3XEe8OMBrzt8\
\="
]
}
}
}
}
}