[Openid-specs-ab] What does "Token Request" refer to in the Signatures and Encryption section?
Michael.Jones at microsoft.com
Thu Oct 10 23:21:20 UTC 2013
Depending on the transport through which the messages are sent, the integrity of the message might not be guaranteed and the originator of the message might not be authenticated. To mitigate these risks, Request Object, Token Request, ID Token, and UserInfo Response values MAY utilize [JWS] to sign the contents.
To achieve message confidentiality, Request Object, Token Request, ID Token, and UserInfo Response values MAY use [JWE] to encrypt the content.
A Token Request, used other places in the spec, just refers to a request made to the Token Endpoint - which I know of no way to sign or encrypt. We do say how you can sign a JWT used with the private_key_jwt client authentication method, but that's about as close to a match as I could come up with.
Should I just delete these odd uses of Token Request, or does someone want to supply alternative wording that makes sense?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-ab