<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">It’s not specified.</div><div class=""><br class=""></div><div class="">And I don’t think there is any difference if client_assertion/client_assertion_type or signed requests are used.</div><div class=""><br class=""></div><div class="">Myself I’m on the side of Joseph; if your library can do it why not do it always.</div><div class="">I guess the downside is that it is costly, both for the OP and the RP.</div><div class=""><br class=""></div><div class="">So are there any security reason for always doing it ?</div><div class=""><br class=""></div><div class="">As an implementer it would make my life easier to have the behaviour be the same all the time. </div><div class="">Instead of switching between 2 variants.</div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 21 Apr 2020, at 15:10, Brian Campbell <<a href="mailto:bcampbell@pingidentity.com" class="">bcampbell@pingidentity.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">How did/does that work when client_assertion/client_assertion_type were being tacked onto the authz request? Without reevaluating the bigger approach, it sure seemed like client_assertion was trying to be used like a signed request and so it seems like an actual signed request object should just be a more appropriate replacement. <br class=""></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 21, 2020 at 12:57 AM Roland Hedberg <<a href="mailto:roland@catalogix.se" class="">roland@catalogix.se</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;" class=""><br class=""><div class="">If we use signed request objects, do we mandate it for all authorization requests or just for the first one.</div></div></blockquote></div></div>
<br class="">
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)" class=""><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600" class=""><font size="2" class="">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i></div></blockquote></div><br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">— Roland</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Can anything be sadder than work left unfinished? Yes, work never begun. -Christina Rossetti, poet (5 Dec 1830-1894) </div>
</div>
<br class=""></div></body></html>