Subject: [OAUTH-WG] 2119 abuse at the end of section 3 proof-of-possession-02

From: Brian Campbell <[email-masked]>
Date: Sun, 22 Mar 2015 19:54:00 -0600

At the end of section 3
<https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-3>
it says, 'At least one of the "sub" and "iss" claims MUST be present in the
JWT, and in some use cases, both MUST be present.'

Admittedly I've misused RFC 2119 keywords a few times myself, so I say this
aware of my own hypocrisy, but shouldn't the second "MUST" in that
sentience be a little "must"? I don't think "some use cases" is enough to
know when it applies. Maybe even spitting it up into two sentences?
Something like, 'At least one of the "sub" and "iss" claims MUST be present
in the JWT. Some use cases may require that both be present.'

---

From: Nat Sakimura <[email-masked]>
Date: Mon, 23 Mar 2015 13:12:25 +0900

+1

2015-03-23 10:54 GMT+09:00 Brian Campbell <[email-masked]>:

> Admittedly I've misused RFC 2119 keywords a few times myself, so I say
> this aware of my own hypocrisy, but shouldn't the second "MUST" in that
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en