From eb709bcd67a770422256c2669ba9ec961272f050 Mon Sep 17 00:00:00 2001 From: Michael Jones Date: Mon, 18 Nov 2024 09:41:43 -0800 Subject: [PATCH] Addressed Ralph's comments --- draft-jones-oauth-rfc7523bis.xml | 43 ++++++++++++++++++++++++++------ 1 file changed, 35 insertions(+), 8 deletions(-) diff --git a/draft-jones-oauth-rfc7523bis.xml b/draft-jones-oauth-rfc7523bis.xml index 0df5ca4..0b2c11c 100644 --- a/draft-jones-oauth-rfc7523bis.xml +++ b/draft-jones-oauth-rfc7523bis.xml @@ -278,14 +278,15 @@ used as the audience of the JWT; this includes that the token endpoint URL of the authorization server MUST NOT be used as an audience value. - It is RECOMMENDED that the aud claim value + To simplify implementations, + the aud claim value MUST be a JSON string, and not a single-valued JSON array. - The authorization server MUST reject any JWT that does not - contain its issuer identifier as its sole audience value. - In the absence of an application profile specifying - otherwise, compliant applications MUST compare the audience - values using the Simple String Comparison method defined in Section - 6.2.1 of RFC 3986 . + The authorization server MUST reject any JWT that does not + contain its issuer identifier as its sole audience value. + In the absence of an application profile specifying + otherwise, compliant applications MUST compare the audience + values using the Simple String Comparison method defined in Section + 6.2.1 of RFC 3986 . The JWT MUST contain an exp @@ -458,7 +459,8 @@ the OAuth 2.0 Dynamic Client Registration Protocol , OAuth 2.0 Authorization Server Metadata , OpenID Connect Dynamic Client Registration 1.0 , - and OpenID Connect Discovery 1.0 . + OpenID Connect Discovery 1.0 , + and OpenID Federation 1.0 . The RS256 algorithm, from , is a mandatory-to-implement JSON Web @@ -607,6 +609,31 @@ + + + OpenID Federation 1.0 + + independent + + + Self-Issued Consulting + + + Sikt + + + Yubico + + + independent + + + Connect2id + + + + + OAuth Parameters