Collect things that would need to happen to use the PAR endpoint

[aaronpk]

We'll send an email to the list about this when we have a more complete list, to settle on whether or not to use the PAR endpoint.

[aaronpk]

• The AS needs to know whether to treat this as a plain PAR request or a first-party request

[aaronpk]

• no new parameters defined at the PAR endpoint
• step-up is handled by the RS returning the standard step-up parameters, the client putting those into the PAR request, then includes the request_uri and auth_session at the challenge endpoint

[aaronpk]

The PAR response would need to be extended to enable returning responses other than request_uri. This feels like a dealbreaker to me since that is not an existing extension point in PAR, so is effectively something totally new.