awkward logic around client support for OAUTB or MTLS

[Brian Campbell]

Part 2 section 5.2.3 Public Client has "shall support OAUTB as a holder of key mechanism;" and then 5.2.4 Confidential Client has "In addition to the provision to the Public Client and the provisions of clause 5.2.3, the Confidential Client [...] shall support OAUTB or MTLS as a holder of key mechanism;"

I think I understand the intent that a public client needs to do OAUTB while a confidential client needs to do either OAUTB or MTLS. But the way that it reads, in trying to translate that text into logic, it might suggest that support of OAUTB is the only thing that fulfills the requirement because 5.2.3 has "shall support OAUTB" and 5.2.4 picks up that provision.

[Nat Sakimura]

Noted.

Could you propose a concrete text to fix the problem?

[Brian Campbell]

I'm not really sure. The way things are structured makes it hard to do this kind of thing where a section inherits most but not all the provisions of another section.

Maybe insert a ", with the exception of OAUTB as the only holder of key mechanism," between the "5.2.3" and the "the Confidential" in the first sentence of 5.2.4? That would be similar to way that section 5.2.4 of part one has "except for RFC7636 support,".

[Nat Sakimura]

That probably works.

[Nat Sakimura]

Part 2: Fixed #113

→ <<cset fd6203e330e0>>