The value=null + essential=true operator combination must be prohibited

[vdzhuvinov]

The current draft allows value + essential combinations unconditionally.

https://openid.github.io/federation/main.html#section-6.1.3.1.1

The special case when a value=null is combined with an essential=true can never be satisfied, hence that's an inconsistent policy.

Example:

TA policy to clear any logo URI from RP metadata:

{
  "logo_uri": {
     "value": null
  }
}

Intermediate policy:

{
  "logo_uri": {
     "essential": true
  }
}

Under the current rules the combination is allowed, resulting in:

{
  "logo_uri": {
     "value": null,
     "essential": true
  }
}

Metadata will always fail this policy combination, hence that could never cause a security issue.

The fix: The combination of value + essential must be made conditional: value MAY be combined with essential, except when value is null and essential false.

[vdzhuvinov]

Addressed in PR #177 , commit dd97c75