docs: guides to mTLS, Message Signing, CIBA, RAR and OpenID Federation

[osanderson]

Summary

These are five more docs/guides pages in the same form as the DPoP, PAR and native-app guides (#546). Each covers one mechanism across every role involved, and links the demo code that shows it running.

Guide	Covers
Mutual TLS in Go	Certificate client authentication and certificate-bound tokens (RFC 8705); client and server trust configuration, including CRLs and proxies; the resource server's binding check. The demo is payroll-run.
FAPI 2.0 Message Signing in Go	Selecting the profile, signed request objects (JAR) and authorization responses (JARM), and signed UserInfo. The demos are payment-consent and identity-check.
CIBA in Go	Poll and ping delivery on the client, and the server's begin, complete and exchange steps. The demo is decoupled-checkout.
Rich Authorization Requests in Go	Defining types, per-client types, policies, approving at consent, and reading grants at the resource server. The demos are payment-consent, linked-accounts and decoupled-checkout.
OpenID Federation in Go	Publishing an Entity Configuration, automatic client registration, the relying party side, and running a Trust Anchor or Intermediate. The demo is federated-union.

The guides index and the README list all eight guides.

Verification

• API: every type, field and method comes from the current API.
• Snippets: every Go snippet type-checks, with typed stand-ins for reader-supplied values. Constructors that could fail at runtime were also run as written:
  • client registrations for each mTLS method;
  • the RAR registry, plus RARSet and RARGet round trips, and case-variant and undeclared members refused;
  • a federation resolver with the guide's limits.
• Claims: behaviour claims were checked against the code and doc comments. Demo claims (attack names, files, what each shows) were grep-checked. Corrections made while writing:
  • what New enforces under Message Signing;
  • signed UserInfo being a server-wide setting, not per client;
  • the RAR policy wording for client credentials;
  • NoClientCertificateChainTrust's meaning;
  • CIBA's full list of attacks;
  • federation's required FederationHTTP;
  • two link references that never rendered as links.
• Links: none broken. The identifier scan finds no new unresolved references.

Docs only.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud