<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Good point about multi Tennent.<div class=""><br class=""></div><div class="">The sector_identifyer covers multiple clients so is not useful for identifying a single client across registrations.</div><div class=""><br class=""></div><div class="">The right way to do it is the <font face="Helvetica Neue" class="">draft-ietf-oauth-dyn-reg-management, or don’t use symmetric keys for client authentication.</font></div><div class=""><font face="Helvetica Neue" class=""><br class=""></font></div><div class=""><font face="Helvetica Neue" class=""><br class=""></font><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 26, 2014, at 6:19 PM, Chuck Mortimore <<a href="mailto:cmortimore@salesforce.com" class="">cmortimore@salesforce.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I don't think jwks_uri should be used as an identifier for. For many large providers this key URL might be common across multiple tenants, and hence cannot be used to uniquely identify a client. In addition, many providers may not choose to use URLs for their keys.<div class=""><br class=""></div><div class="">client_id really should be how clients are identified</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Wed, Nov 26, 2014 at 1:02 PM, Mike Schwartz <span dir="ltr" class=""><<a href="mailto:mike@gluu.org" target="_blank" class="">mike@gluu.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 2014-11-26 14:23, John Bradley wrote:<br class="">
<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I think I recommended using the jwks_uri in registration for the<br class="">
client to publish an endpoint for it’s keys if it is going to rotate<br class="">
them.<br class="">
<br class="">
</blockquote>
<br class=""></span>
jwks_uri is a great idea...<br class="">
<br class="">
To update the client secret, a new client is registered with the same jwks_uri?<br class="">
<br class="">
And "Sector Identifier" also looks very interesting. Good point Mike Jones...<span class="HOEnZb"><font color="#888888" class=""><br class="">
<br class="">
- Mike Schwartz<br class="">
Gluu<br class="">
</font></span></blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></div></div></body></html>