[OAUTH-WG] JWT Response for OAuth Token Introspection and types of tokens

[Andrii Deinega <[e-mail]>]

Hi WG,

draft-ietf-oauth-jwt-introspection-response-10 states that "OAuth 2.0 Token
Introspection [RFC7662] specifies a method for a protected resource to
query an OAuth 2.0 authorization server to determine the state of an access
token and obtain data associated with the access token." which is true.
Although, according to RFC7662, the introspection endpoint allows to
introspect a refresh token as well. Hence, the question I have is how will
a token introspection response look like when the caller provides a refresh
token and sets the "Accept" HTTP header to
"application/token-introspection+jwt"?

I expect there will be no differences, right?

If so, I suggest to

   1. replace "a resource server" by "the caller" in section 4 (Requesting
   a JWT Response)
   2. change "If the access token is invalid, expired, revoked" by "If a
   given token is invalid, expired, revoked" in section 5 (JWT Response)

If not, my suggestion would be to clarify what the AS should do when it
asked to introspect the refresh token in general and additionally, what
should happen in the same case based on the type of the caller from the
AS's point of view.

Regards,
Andrii