diff --git a/draft-jones-oauth-rfc7523bis.xml b/draft-jones-oauth-rfc7523bis.xml
index 0df5ca4..0b2c11c 100644
--- a/draft-jones-oauth-rfc7523bis.xml
+++ b/draft-jones-oauth-rfc7523bis.xml
@@ -278,14 +278,15 @@
used as the audience of the JWT;
this includes that the token endpoint URL of the authorization server
MUST NOT be used as an audience value.
- It is RECOMMENDED that the aud claim value
+ To simplify implementations,
+ the aud claim value MUST
be a JSON string, and not a single-valued JSON array.
- The authorization server MUST reject any JWT that does not
- contain its issuer identifier as its sole audience value.
- In the absence of an application profile specifying
- otherwise, compliant applications MUST compare the audience
- values using the Simple String Comparison method defined in Section
- 6.2.1 of RFC 3986 .
+ The authorization server MUST reject any JWT that does not
+ contain its issuer identifier as its sole audience value.
+ In the absence of an application profile specifying
+ otherwise, compliant applications MUST compare the audience
+ values using the Simple String Comparison method defined in Section
+ 6.2.1 of RFC 3986 .
The JWT MUST contain an exp
@@ -458,7 +459,8 @@
the OAuth 2.0 Dynamic Client Registration Protocol ,
OAuth 2.0 Authorization Server Metadata ,
OpenID Connect Dynamic Client Registration 1.0 ,
- and OpenID Connect Discovery 1.0 .
+ OpenID Connect Discovery 1.0 ,
+ and OpenID Federation 1.0 .
The RS256 algorithm, from , is a mandatory-to-implement JSON Web
@@ -607,6 +609,31 @@
+
+
+ OpenID Federation 1.0
+
+ independent
+
+
+ Self-Issued Consulting
+
+
+ Sikt
+
+
+ Yubico
+
+
+ independent
+
+
+ Connect2id
+
+
+
+
+
OAuth Parameters