MTLS only for Protected resources provisions?

[Brian Campbell]

The 6.2.1 Protected resources provisions say that they "shall adhere to the requirements in MTLS." which would seem to preclude OAUTB even though it is cited elsewhere in the document?

[Nat Sakimura]

Noted. Good point. That clearly is not the intent because if so, the previous requirement re: TOKB become meaningless.

If you can provide a concrete text to fix it (and a PR), it would be great.

[Brian Campbell]

PR at https://bitbucket.org/openid/fapi/pull-requests/30/allow-for-oautb-or-mtls-in-protected/diff

I just added an "... or OAUTB". I'm not sure how else to work within the document as it is and only want to make minor changes.

[Nat Sakimura]

Merged in b_d_c/fapi-1/b_d_c/allow-for-oautb-or-mtls-in-protected-res-1499451422502 (pull request #30)

allow for OAUTB or MTLS in 'Protected resources provisions' per Issue #111 and update those two references

Approved-by: Nat Sakimura [e-mail]

Fixed #111

→ <<cset 174443502ae0>>