Subject: [OAUTH-WG] Registered token_endpoint_auth_method with bearer assertion grant

From: Vladimir Dzhuvinov <[email-masked]>
Date: Tue, 10 Nov 2015 10:54:54 +0200

Hi,

I've got a query regarding a use case:

1. Client with self-issued JWT bearer assertion grant
2. No explicit client auth, i.e. authentication is done via the
presented JWT grant

What value should then the *token_endpoint_auth_method* reg parameter
for the client have?

"none" is apparently reserved for public clients:
http://tools.ietf.org/html/rfc7591#section-2

Empty value perhaps?

Thanks,

Vladimir

---

From: Brian Campbell <[email-masked]>
Date: Tue, 10 Nov 2015 06:09:59 -0700

Despite the text in RFC 7591, IMHO "none" is still what you'd use here -
"none" describes what will be used for explicit client authentication. And
that's what the AS needs to know.

On Tue, Nov 10, 2015 at 1:54 AM, Vladimir Dzhuvinov <[email-masked]
> wrote:

> 2. No explicit client auth, i.e. authentication is done via the presented
> JWT grant
>
> What value should then the *token_endpoint_auth_method* reg parameter for
> the client have?
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Wed, 11 Nov 2015 08:58:35 +0200

Thanks Brian. We'll put a note in the SDK so developers are aware of this.

-- 
Vladimir Dzhuvinov :: [email-masked]