Re: [OAUTH-WG] Dynamic Client Registration - client_secret_expires_at

[Travis Spencer <[e-mail]>]

On Tue, Nov 20, 2018 at 12:45 PM Filip Skokan <[e-mail]> wrote:

> This is my best shot at an implementable policy when it comes to clients
> with expired client secrets: *"all operations requiring a secret will be
> rejected when an expired one is presented"*
>

This is a good list and hopefully something that would find its way into a
spec and not be buried in an email archive. With this info, its a lot
easier to make use of this feature of the spec. Thanks for sharing it,
Filip.

it is not valid for client secret based endpoint auth (basic, post, client
> secret jwt), the AS will reject with 401 invalid_client in those cases
>

Or instead of invalid_client, need_info.

it will not be used for validating symmetrically signed request object
> (JAR), the AS will reject the authorization request with ...?
>

400 invalid_request_object

it will not be used by the AS to symmetrically sign id tokens, userinfo,
> introspection or authorization responses (JARM), the AS will reject the
> requests with ...?
>

403 need_info.

In the case of introspection, a client secret can't be used to sign the JWT
if application/jwt was requested because access will be denied will be
denied before that point. So, that's 401 (first point above)

anything else?
>

Revoke -- 401