Hi all, Following a review / feedback on the CIMD draft from Max Gerber, we realised that there was no way for an Authorization Server to signal to a client that it always required DPoP bound access tokens. The only way to currently indicate this was at a resource server level, not an authorization server.
As such I've written up a first draft of adding `dpop_bound_access_tokens_required` to Authorization Server Metadata (RFC8414) via the appropriate registry: https://datatracker.ietf.org/doc/draft-emelia-oauth-as-metadata-dpop-required/ I think there may still be some changes required, but wanted to publish now such that we can discuss briefly at IETF 127 since it relates to the new version of CIMD. Yours, Emelia Smith _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
