[OAUTH-WG] Questions about error cases on RFC 7523

nov matake <nov@matake.jp> Thu, 29 July 2021 01:09 UTC

From: nov matake <nov@matake.jp>
Content-Type: multipart/alternative; boundary="Apple-Mail=_300D3C0A-4323-473F-9D4A-E5C3A204CD05"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\))
Message-Id: <FCF75E67-E7BD-41BC-B10B-3ECC1B7AA9E4@matake.jp>
Date: Thu, 29 Jul 2021 10:08:52 +0900
To: oauth <oauth@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/vb-T5Oh9r8c6jVqtxyUkbHt6fMA>
Subject: [OAUTH-WG] Questions about error cases on RFC 7523
Precedence: list

Hi,

I have 2 questions about RFC 7523’s error cases.

1st one is about section 3.2, which requires “invalid_client” error when client assertion JWT is invalid.
In such case, what scheme is expected for WWW-Authentication header? I believe it’s not Basic, but not sure what is appropriate.
https://www.rfc-editor.org/rfc/rfc7523.html#section-3.2 <https://www.rfc-editor.org/rfc/rfc7523.html#section-3.2>

2nd one is about section 4.2.1, which requires “invalid_client” error when multiple client authentication mechanism is used.
RFC 6749 section 5.2 requires “invalid_request” for such case, so it seems those 2 definitions are conflicting.
Do we need to return “invalid_client” if multiple authentication mechanism include client assertion, and otherwise return “invalid_request”?
https://www.rfc-editor.org/rfc/rfc7521.html#section-4.2.1 <https://www.rfc-editor.org/rfc/rfc7521.html#section-4.2.1>
https://www.rfc-editor.org/rfc/rfc6749#section-5.2 <https://www.rfc-editor.org/rfc/rfc6749#section-5.2>

thanks

nov

[OAUTH-WG] Questions about error cases on RFC 7523 nov matake
Re: [OAUTH-WG] Questions about error cases on RFC… nov matake