Re: [OAUTH-WG] draft-ietf-oauth-mtls-03: enforcing mutual_tls_sender_constrained_access_tokens

"invalid_client" is the appropriate error, if the client is
configured/registered for MTLS authentication, because it's effectively
failed client authentication.

I would say that "invalid_request" is probably the appropriate error for a
public client with mutual_tls_sender_constrained_access_tokens=true that
doesn't provide the TLS client certificate with the token request. There is
effectively a missing required parameter in the context of the request.

On Sun, Aug 27, 2017 at 1:46 AM, Vladimir Dzhuvinov <vladimir@connect2id.com
> wrote:

> Let's suppose that an OAuth 2.0 client is registered for
>
> mutual_tls_sender_constrained_access_tokens=true
>
>
> Is it correct that in the presence of this parameter, and regardless of
> how "token_endpoint_auth_method" is set, the AS must require a client X.509
> cert to be passed to the token endpoint? If yes, then what error should the
> AS return if no client cert is passed with the token request?
>
> https://tools.ietf.org/html/rfc6749#section-5.2
>
> Thanks,
>
> Vladimir
>
> PS: Noticed a typo - "manor" in #section-4.3
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*