generated: '2026-08-05'
method: probed
source: https://scs.sifive.com/.well-known/oauth-authorization-server
docs: https://www.sifive.com/software/sifive-core-designer
description: >-
  SiFive has no public REST API with an OpenAPI to derive security schemes from, so this
  profile is probed directly from the live RFC 8414 Authorization Server Metadata that the
  SiFive Cloud Services (SCS) portal serves anonymously. Every value below is copied from
  that document or from a probe of the endpoint it names.
summary:
  types: [oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, refreshToken]
  pkce: [S256]
  implementation: django-oauth-toolkit
schemes:
- name: SiFiveCloudServicesOAuth2
  type: oauth2
  source: https://scs.sifive.com/.well-known/oauth-authorization-server
  issuer_declared: http://localhost:8000/o
  issuer_actual: https://scs.sifive.com/o
  flows:
  - flow: authorizationCode
    authorizationUrl: https://scs.sifive.com/o/authorize/
    tokenUrl: https://scs.sifive.com/o/token/
    scopes: [openid, 'mcp:read', 'mcp:write']
  - flow: refreshToken
    tokenUrl: https://scs.sifive.com/o/token/
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
  code_challenge_methods: [S256]
  response_types: [code]
  id_token_signing_alg: [RS256]
  subject_types: [public]
endpoints:
- {name: authorization, url: 'https://scs.sifive.com/o/authorize/', probed_status: 302}
- {name: token, url: 'https://scs.sifive.com/o/token/', probed_status: 405, note: 'GET rejected; POST only'}
- {name: registration, url: 'https://scs.sifive.com/o/register/', probed_status: 405, spec: 'RFC 7591 dynamic client registration'}
- {name: revocation, url: 'https://scs.sifive.com/o/revoke_token/', probed_status: 405, spec: 'RFC 7009'}
- {name: introspection, url: 'https://scs.sifive.com/o/introspect/', probed_status: 403, spec: 'RFC 7662'}
- {name: userinfo, url: 'https://scs.sifive.com/o/userinfo/', probed_status: 401, spec: 'OIDC Core 1.0'}
- {name: jwks, url: 'https://scs.sifive.com/o/.well-known/jwks.json', probed_status: 200, note: 'empty key set'}
observations:
- id: issuer-points-at-localhost
  severity: high
  finding: >-
    The production metadata document declares issuer "http://localhost:8000/o" and every
    endpoint URL as "http://localhost:8000/o/...". The real, working endpoints are on
    https://scs.sifive.com/o/. A spec-conformant OAuth client that follows RFC 8414 and
    RFC 9207 issuer validation cannot use this document as published: it will either
    refuse the mismatched issuer or attempt cleartext HTTP to a loopback address.
  evidence: well-known/sifive-oauth-authorization-server.json
  remedy: >-
    Set the deployment's OAUTH2_PROVIDER issuer/base URL to https://scs.sifive.com/o so the
    metadata document reflects the deployed origin.
- id: empty-jwks
  severity: medium
  finding: >-
    id_token_signing_alg_values_supported declares RS256 but the advertised jwks_uri
    returns {"keys": []}, so no relying party can verify a signed ID token from published
    key material.
  evidence: well-known/sifive-jwks.json
- id: no-openid-configuration
  severity: low
  finding: >-
    The "openid" scope and RS256 ID-token signing are advertised, but
    /.well-known/openid-configuration returns 404 — OIDC discovery is not served, only the
    OAuth 2.0 (RFC 8414) variant.
- id: token-endpoint-auth-none-allowed
  severity: informational
  finding: >-
    token_endpoint_auth_methods_supported includes "none", which is the expected posture
    for public clients paired with the mandatory-looking S256 PKCE support.
x-evidence:
  fetched: '2026-08-05'
  url: https://scs.sifive.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json