Subject: Re: [OAUTH-WG] AS in introduction of proof-of-possession-02

From: Mike Jones <[email-masked]>
Date: Tue, 11 Aug 2015 03:42:02 +0000

-03 updated the language that formerly assumed that the issuer was an OAuth 2.0 authorization server.

                                                            -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Sunday, March 22, 2015 6:14 PM
To: oauth
Subject: [OAUTH-WG] AS in introduction of proof-of-possession-02

The introduction<https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-1> talks about an OAuth 2.0 authorization server as the JWT issuer, however, the term authorization server doesn’t appear anywhere else in the draft. Proof-of-possession semantics for JWT certainly can be applicable when an AS is the issuer but this draft has wider applicability than that. I might suggest that the introduction drop the authorization server talk in favor of something more general. Or clarify that an AS is just one potential issuer. As it is now, the intro reads overly specific.