Do we need a special JWT type

[Roland Hedberg]

We use JWTs as the format for trust marks. Is there a reason for registering a special JWT type for this usage.

DPoP has dpop+jwt should we have trust_mark+jwt ?

[Giuseppe De Marco]

In “JWT Response for OAuth Token Introspection“ we also have “token-introspection+jwt” and it has been included in the JSON Web Token (JWT) IANA registry.
I believe it is formally correct to have a registered claim for the trust marks of oidc federation 1.0

+1 on my side

[Joseph Heenan]

Yes, explicit typing is recommended in the JWT BCP: https://www.rfc-editor.org/rfc/rfc8725.html#section-3.11

There seems to be at least a precedent for the use of - rather than _ in https://www.iana.org/assignments/media-types/media-types.xhtml (which is where it will need to be registered), so trust-mark+jwt might be a better choice?

[Roland Hedberg]

Agree !

[Giuseppe De Marco]

What about registering a type also for Fetch Entity Statements Response and any other federation_api operation?

[Michael Jones]

Mike to work with Roland on spec text defining these JWT types.

[Giuseppe De Marco]

some content types have been proposed here:
https://bitbucket.org/openid/connect/issues/1382/proposal-of-an-improved-federation-api

[Roland Hedberg]

Mike has added spec text defining a couple of JWT types.