On 28/08/17 18:53, Brian Campbell wrote: > "invalid_client" is the appropriate error, if the client is > configured/registered for MTLS authentication, because it's effectively > failed client authentication. > > I would say that "invalid_request" is probably the appropriate error for a > public client with mutual_tls_sender_constrained_access_tokens=true that > doesn't provide the TLS client certificate with the token request. There is > effectively a missing required parameter in the context of the request. Thanks, "invalid_request" does indeed look like the best fit to signal the request is incomplete (missing TLS client cert).
Vladimir > On Sun, Aug 27, 2017 at 1:46 AM, Vladimir Dzhuvinov <[email protected] >> wrote: >> Let's suppose that an OAuth 2.0 client is registered for >> >> mutual_tls_sender_constrained_access_tokens=true >> >> >> Is it correct that in the presence of this parameter, and regardless of >> how "token_endpoint_auth_method" is set, the AS must require a client X.509 >> cert to be passed to the token endpoint? If yes, then what error should the >> AS return if no client cert is passed with the token request? >> >> https://tools.ietf.org/html/rfc6749#section-5.2 >> >> Thanks, >> >> Vladimir >> >> PS: Noticed a typo - "manor" in #section-4.3 >> >> _______________________________________________ >> OAuth mailing list >> [email protected] >> https://www.ietf.org/mailman/listinfo/oauth >> >> -- Vladimir Dzhuvinov :: [email protected]
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
