oauth2 Profile - 3.2. @torsten comment

[Paul Grassi]

Section describes use of JWTs and Introspection to convey token data. Are both mechanisms a mandatory to implement requirement for every iGov compliant AS? How is the AS supposed to determine what kind of token to issue for a particular token request?

[Giuseppe De Marco]

In the current text the introspection endpoint is OPTIONAL

AT in JWT format is a good solution for enabling some metadata in a token that otherwise would be opaque.

the value of having AT in JWT format is that on the basis of the claims contained therein, it may or may not be necessary to adopt introspection endpoints

having introspection as optional, only the JWT format gives the AT the minimum properties for good interoperability

[Giuseppe De Marco]

linked to https://bitbucket.org/openid/igov/issues/15/oauth2-profile-321-torsten-comment

[Tom Clancy]

Changed to BLOCKER to filter for v1.05/Implementer’s draft.

[Kelley Burgin]

JWTs are required and Introspection is not.

[Kelley Burgin]

JWTs are required, introspection is not (MAY)