Subject: [OAUTH-WG] draft-ietf-oauth-assertions WGLC comment

From: Brian Campbell <[email-masked]>
Date: Mon, 23 Apr 2012 06:41:38 -0600

§6.1 on Client authentication* has the following requirement,

"The Principal MUST identify an authorized accessor. If the assertion is
self-issued, the Principal SHOULD be the client_id."

which doesn't really make sense for client authentication.  The
self-issuedness of the assertion should have no bearing on the principal
(rather the issuer) and, when used for client authentication, the principal
should always represent the client.  I believe the bullet should instead
say,

"The Principal SHOULD be the client_id."

* http://tools.ietf.org/html/draft-ietf-oauth-assertions-01#section-6.1