How to indicate certain credential configurations need oauth client attestation?
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
Perhaps this issue should be filed in a different repository.
Two questions:
- Should we define a mechanism that some of the credential configurations require oauth client attestation while others may not?
- Would it make sense to define a token endpoint auth method for oauth client attestation to indicate oauth client auth is supported, e.g., by including it in the
token_endpoint_auth_methods_supportedmetadata?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the two questions in issue #302 about credential configurations, OAuth client attestation, and token endpoint authentication metadata. Done would require an agreed mechanism or specification decision, including whether attestation is required for selected configurations and how support is indicated.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100