Use builtin sphinx RFC references

doc/sources/admin/idpopenidconnect.rst

@@ -30,10 +30,8 @@ As an OP, LL::NG supports a lot of OpenID Connect features:
 -  Session management
 -  FrontChannel Logout
 -  BackChannel Logout
--  PKCE (Since ``2.0.4``) - See `RFC
-   7636 <https://tools.ietf.org/html/rfc7636>`__
--  Introspection endpoint (Since ``2.0.6``) - See `RFC
-   7662 <https://tools.ietf.org/html/rfc7662>`__
+-  PKCE (Since ``2.0.4``) - See :rfc:`7636`
+-  Introspection endpoint (Since ``2.0.6``) - See :rfc:`7662`
 -  Offline access (Since ``2.0.7``)
 -  Refresh Tokens (Since ``2.0.7``)
 
@@ -318,7 +316,7 @@ Options
       return it as a JWT, using one of the available signature algorithms.
    -  **Require PKCE** (since version ``2.0.4``): a code challenge is
       required at token endpoint (see
-      `RFC7636 <https://tools.ietf.org/html/rfc7636>`__)
+      :rfc:`7636`)
    -  **Allow offline access** (since version ``2.0.7``): After enabling
       this feature, an application may request the **offline_access**
       scope, and will obtain a Refresh Token that persists even after
@@ -362,7 +360,7 @@ The Resource Owner Password Credentials Grant allows you to exchange a user's lo
 
 .. seealso::
 
-   `Specification for the Resource Owner Password Credentials Grant <https://tools.ietf.org/html/rfc6749#section-4.3>`__
+   Specification for the Resource Owner Password Credentials Grant: :rfc:`6749#section-4.3`
 
 .. _client-credentials-grant:
 
@@ -390,7 +388,7 @@ mapped to Exported Attributes and Extra Claims
 
 .. seealso::
 
-   `Specification for the Client Credentials Grant <https://tools.ietf.org/html/rfc6749#section-4.4>`__
+   Specification for the Client Credentials Grant: :rfc:`6749#section-4.4`
 
 Macros
 ^^^^^^

doc/sources/admin/oauth2handler.rst

@@ -72,7 +72,7 @@ Define access rules and headers. Then in ``Options`` > ``Type``, choose
 Reference
 ---------
 
-`RFC6750 <https://tools.ietf.org/html/rfc6750>`__
+:rfc:`6750`
 
 .. |image0| image:: /documentation/oauth-retina-preview.jpg
    :class: align-center

doc/sources/admin/upgrade_2_0_x.rst

@@ -420,7 +420,7 @@ Please note that it is HIGHLY recommended to set certificate validation to `requ
 -  OAuth2.0 Handler: a VHost protected by the OAuth2.0 handler will now
    return a 401 when called without an Access Token, instead of
    redirecting to the portal, as specified by
-   `RFC6750 <https://tools.ietf.org/html/rfc6750>`__
+   :rfc:`6750#section-3`.
 
 -  If you encounter the following issue:
 

doc/sources/admin/webserviceprotection.rst

@@ -58,10 +58,9 @@ For example:
 Introspection
 ~~~~~~~~~~~~~
 
-Introspection endpoint is defined in `RFC
-7662 <https://tools.ietf.org/html/rfc7662>`__. It requires an
-authentication (same as the authentication for the token endpoint) and
-takes to access token as parameter.
+Introspection endpoint is defined in :rfc:`7662`. It requires an authentication
+(same as the authentication for the token endpoint) and takes to access token
+as parameter.
 
 For example: