Messages - Align Token endpoint Authentication with oauth-jwt-bearer

[John Bradley]

Align Token endpoint Authentication with oauth-jwt-bearer

[Former user]

Align how exactly? The clients could be issued any number of identities and secrets, which could be passed via BASIC or the form parameters or JWT or ...

What exactly do we get by specifying a JWT style client auth? And doesn't the dynamic registration issue a client ID and optional secret, not a JWT?

[John Bradley]

re #334 Messages - 2.2.1 make claims consistent with oauth-jwt-bearer

→ fcec13a24505

[John Bradley]

Fix #334 Messages - Add example and reference.

→ 37b4530e633d

[Michael Jones]

I really doubt that this use of SAML was intended in the Messages spec: client_assertion_type=urn%3Aoasis%3Anames%sAtc%3ASAML%3A2.0%3Aassertion&

Also, the “iat” usage should become “nbf” (Not Before), per the current JWT spec.

[John Bradley]

Fix #334 Messages - fix example, change nonce to token id.

→ 6e27578ad51e