"invalid_token" according to the last paragraph of https://tools.ietf.org/html/draft-ietf-oauth-mtls-03#section-3 which says that the RS, 'MUST verify that the certificate matches the certificate associated with the access token. If they do not match, the resource access attempt MUST be rejected with an error per [RFC6750] using an HTTP 401 status code and the "invalid_token" error code.'
On Sun, Aug 13, 2017 at 9:00 AM, Vladimir Dzhuvinov <[email protected] > wrote: > Hello, > > Implementing mTLS on the RS side raised the following question: > > What error code should the RS return if the x5t#S256 bound to the access > token token doesn't match the hash of the submitted client certificate? > > Here are the error codes already defined in "bearer token usage": > > https://tools.ietf.org/html/rfc6750#section-3.1 > > Thanks, > Vladimir > > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > > -- *CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.*
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
