Define error code to indicate the client should *not* fall back to redirect-based OAuth flow

[aaronpk]

Once an app is connected through this mechanism, an admin might want to prevent users from going through an interactive OAuth flow entirely.

[mcguinness]

Is this the IdP or the Resource AS returning this error? If the IdP returned this error on Token Exchange, what would prevent a client from initiating an authorization code flow for the Resource AS ? The Resource AS would need to reject the grant which is already supported I thought with unauthorized_client.