<html><head><base href="x-msg://167/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>For discussion:</div><div><br></div><div>Dynamic client registration and secret rotation.</div><div><br></div><div>Thinking about it, It makes more sense to have the IdP configuration information as part of registration.</div><div><br></div><div>One flow could be having a RP go to a web page and do a manual registration, then plug in their client_id, client_secret, return_to, and Idp client registration endpoint into their software and have it do a refresh to get the other parameters.</div><div><br></div><div>I suspect that the Client Registration endpoint will need to also be the issuer_id. Without introducing a post authentication discovery step we need to map the signature on the session token back to a shared secret (or public key) If we allow the other endpoints to be on other domains potentially, that leaves the registration one as the likely choice.</div><div><br></div><div>John B.</div><div><br></div></body></html>