FAPI 2 - Multiple audience values in client authentication assertions

[Dave Tonge]

Torsten raised this - there was a suggestion that we restrict the audience to being a single value.

[Joseph Heenan]

There’s a whole bunch of previous discussion about this that starts from here: https://bitbucket.org/openid/fapi/issues/403/proposed-new-fapi-certification-test

If we go this way then I guess we won’t implement the certification test proposed there after all

[Brian Campbell]

some concern that this would cause more issues than it solves

[Dave Tonge]

we had a discussion on the call today.

Brian and Travis are quite concerned about how this would be implemented, and think the added complexity outweighs any benefits.

Torsten is still keen for us to provide a clear interoperable specification that uses a single audience value.

We will leave this ticket open for further discussion.

[Dave Tonge]

We had another discussion on today’s call.

There was a rough agreement that the current text is helpful. However we discussed requiring the Client to sent the value as a string not an array.

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/287/add-requirement-for-clients-to-send-issuer

[Dave Tonge]

PR was merged