generated: '2026-07-19'
method: searched
source: https://auth.jooraccess.com/auth/realms/joor/.well-known/openid-configuration
standards:
- id: openid-connect
  conforms: true
  evidence: >-
    Live OIDC discovery document at
    auth.jooraccess.com/auth/realms/joor/.well-known/openid-configuration with
    issuer, authorization/token/userinfo/introspection/jwks endpoints and
    id_token signing algorithms.
- id: oauth2
  conforms: true
  evidence: >-
    OAuth 2.0 authorization/token endpoints; grant types include
    authorization_code, client_credentials, refresh_token, device_code and CIBA.
- id: oauth2-pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256.
- id: rfc8705-mtls-client-auth
  conforms: true
  evidence: token_endpoint_auth_methods_supported includes tls_client_auth.
- id: private-key-jwt-client-auth
  conforms: true
  evidence: token_endpoint_auth_methods_supported includes private_key_jwt.
- id: fapi2
  conforms: false
  evidence: >-
    Building blocks are present (PKCE S256, private_key_jwt, tls_client_auth),
    but JOOR publishes no FAPI 2.0 security-profile conformance claim.
- id: rfc9457-problem-details
  conforms: false
  evidence: No public JOOR OpenAPI/error reference to confirm application/problem+json.
notes: >-
  Derived from the live Keycloak realm discovery only. JOOR does not publish a
  public developer portal, API reference, or a certifications/compliance program
  page, so no Compliance pointer is asserted.