"invalid_client" is the appropriate error, if the client is configured/registered for MTLS authentication, because it's effectively failed client authentication.
I would say that "invalid_request" is probably the appropriate error for a public client with mutual_tls_sender_constrained_access_tokens=true that doesn't provide the TLS client certificate with the token request. There is effectively a missing required parameter in the context of the request. On Sun, Aug 27, 2017 at 1:46 AM, Vladimir Dzhuvinov <[email protected] > wrote: > Let's suppose that an OAuth 2.0 client is registered for > > mutual_tls_sender_constrained_access_tokens=true > > > Is it correct that in the presence of this parameter, and regardless of > how "token_endpoint_auth_method" is set, the AS must require a client X.509 > cert to be passed to the token endpoint? If yes, then what error should the > AS return if no client cert is passed with the token request? > > https://tools.ietf.org/html/rfc6749#section-5.2 > > Thanks, > > Vladimir > > PS: Noticed a typo - "manor" in #section-4.3 > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > > -- *CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.*
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
