`token` endpoint with `grant_type` `urn:ietf:params:oauth:grant-type:jwt-bearer` fails to work without `client_id`

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Given an issuer trust relationship, the token endpoint seems to require client_id of a valid client to actually work with the jwt-bearer grant type. This seems to go against the docs on https://www.ory.sh/docs/hydra/guides/jwt as well as RFC.

Did I misunderstand how that features should be used?

From the RFC7523
2.1. Using JWTs as Authorization Grants

To use a Bearer JWT as an authorization grant, the client uses an
access token request as defined in Section 4 of the OAuth Assertion
Framework [RFC7521] with the following specific parameter values and
encodings.

The value of the "grant_type" is "urn:ietf:params:oauth:grant-
type:jwt-bearer".

The value of the "assertion" parameter MUST contain a single JWT.

The "scope" parameter may be used, as defined in the OAuth Assertion
Framework [RFC7521], to indicate the requested scope.

Authentication of the client is optional, as described in
Section 3.2.1 of OAuth 2.0 [RFC6749] and consequently, the
"client_id" is only needed when a form of client authentication that
relies on the parameter is used.

Reproducing the bug

Create issuer trust relationship /admin/trust/grants/jwt-bearer/issuers

{
      "allow_any_subject": true,
      "expires_at": "2029-04-23T18:25:43.511Z",
      "issuer": "https://example.com",
      "jwk": {
        "alg": "HS256",
        "use": "sig",
        "kty": "oct",
        "k": "Fdh9u8rINxfivbrianbbVT1u232VQBZYKx1HGAGPt2I",
        "kid": "default"
      },
      "scope": ["openid"]
}

Exchange token /oauth2/token (urlencoding removed for report)

assertion=...&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&scope=openid

{
  "error": "invalid_request",
  "error_description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Client credentials missing or malformed in both HTTP Authorization header and HTTP POST body."
}

It works when adding the client_id of a client with e.g. token_endpoint_auth_method none

Relevant log output

No response

Relevant configuration

No response

Version

ory/hydra:v2.2.0

On which operating system are you observing this issue?

None

In which environment are you deploying?

Docker Compose

Additional Context

No response

Start by reproducing the POST to /oauth2/token using the issuer trust relationship and JWT-bearer parameters shown in the issue, then compare the behavior with the Ory JWT guide and RFC 7523. Done means a request without client_id succeeds when client authentication is optional, while requests that require authentication continue to be handled correctly.