Stronger recommendation for client authentication#68
Conversation
Clarified client credential management and authentication methods in the metadata document.
| Clients that are capable of maintaining private key material and performing client authentication | ||
| SHOULD do so with an acceptable method. |
There was a problem hiding this comment.
Should this just explicitly say "e.g., private_key_jwt" ?
There was a problem hiding this comment.
I wanted to leave the door open for other methods in the future
There was a problem hiding this comment.
Yeah, I can see that... maybe we could reference https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method ?
|
|
||
| The particular method of how the client manages the private key is out of scope of this specification, but may include manual provisioning or methods such as Attestation Based Client Authentication [I-D.draft-ietf-oauth-attestation-based-client-auth]. For example, the client developer could run a Client Attester Backend, using a native application's platform-specific APIs to authenticate to the backend service, where the private key corresponding to the `jwks_uri` key is managed by the backend service. This would allow a mobile app to request JWTs from the backend service that the mobile app could then use as client authentication to the authorization server. | ||
| When a client declares `token_endpoint_auth_method` as `private_key_jwt`, the authorization server | ||
| MUST require client authentication according to {{Section 2.2 of RFC7523}} using the corresponding key published in the client's metadata document. |
There was a problem hiding this comment.
This makes it sound like we MUST use jwks in the CIMD, instead of jwks_uri (which I think we prefer?)
There was a problem hiding this comment.
yeah that was not my intent. maybe "published or referenced"?
There was a problem hiding this comment.
I'd probably just say "referenced", since embedding is a reference in a way.. maybe "discovered from the client's metadata document" ?
2 participants
Clarified client credential management and authentication methods in the metadata document.