DPoP Optimisation

[tplooker]

Initial draft at this proposal, things to discuss include

• Whether we should consider instead of a _supported metadata flag defining another method for client authentication because otherwise an AS cannot force the optimisation in the event it would like to. Update see latest comment on PR
• Unrelated but I noticed nbf is defined for the Client Attestation PoP when I dont think its required, suggest we remove this. Update created Remove nbf claim definition #181 to address
• How should we handle challenge vs nonce in the DPoP proof, technically we could support both.

Fixes #69

[tplooker]

Should we be more specific around how this matching should occur, e.g if both JWK use thumbprint etc?

[paulbastian]

we're also missing the considerations for challenge/DPoP nonce

[panva]

This should either

• be required by AS to support when it supports both dpop and attest; or
• be required when dpop and attestation is used together; or
• not exist.

Anything towards the end of not having any AS support optionality.

I am supportive of this in theory but if its not MTI for the AS I would not bother implementing the client side for it.

[paulbastian]

This should either

* be required by AS to support when it supports both dpop and attest; or

* be required when dpop and attestation is used together; or

* not exist.

Anything towards the end of not having any AS support optionality.

I am supportive of this in theory but if its not MTI for the AS I would not bother implementing the client side for it.

favorite direction would be to create two distinct token_endpoint_auth_methods, which could be independtly signaled using token_endpoint_auth_methods_supported, therefore leaving the AS the clear option to support either or both. What do you think about this option? @panva

[panva]

@paulbastian yes that's acceptable (I think?).

[tplooker]

I agree with @panva I'm going to update the PR in the direction of making the combined mode required when the AS supports both DPoP and Client Attestation.

[tplooker]

I've made a few changes to this PR

1. Added language requiring that this mode is implemented if the AS also supports DPoP, I think this could be improved though to avoid duplication once usage at par and token endpoint #177 is merged.
2. I reverted the changes that addressed issue Make iss optional in Client Attestation JWT #171 as remove iss from Client Attestation JWT #173 now resolves this and added a few suggestions to that PR instead.