Core 8.1 Pairwise identifier algorithm and native apps

Originally submitted by s-hal (Stefan Halén) on 2016-09-12

If a native app is registered with a redirect URI scheme that do not have a host component the calculating of the sub will fail. Possible solutions would be to demand a sector_identifier_uri or use the whole URI in the calculation of the sub. If the scheme are of other type than https or http and application_type=nativ.

3.1.2.1
The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application.

8.1. Pairwise Identifier Algorithm
If the Client has not provided a value for sector_identifier_uri in Dynamic Client Registration [OpenID.Registration], the Sector Identifier used for pairwise identifier calculation is the host component of the registered redirect_uri. If there are multiple hostnames in the registered redirect_uris, the Client MUST register a sector_identifier_uri.

Bitbucket status: open

Bitbucket origin: issue 1004

Start by reviewing OpenID Connect sections 3.1.2.1 and 8.1, focusing on how sector identifiers are derived for native redirect URI schemes without hosts. Compare the proposed handling options against the specification and define completion as a consistent pairwise identifier calculation for these registrations.