Subject: [OAUTH-WG] draft-ietf-oauth-mtls-03 - auth to other endpoints?

From: Vladimir Dzhuvinov <[email-masked]>
Date: Mon, 7 Aug 2017 18:17:00 +0300

I just noticed that the spec is very explicit on the MTLS auth method
being used for the token endpoint, but it could also work with other
endpoints, e.g. RFC 7009 (revocation), 7662 (intospection).

Were there any talks about that?

Vladimir

---

From: John Bradley <[email-masked]>
Date: Mon, 7 Aug 2017 12:28:32 -0400

Good point,  I don’t think we intended it to be exclusive to the token endpoint.  It is another client auth method and should work those other places as well.   I will need to look at the other specs to see how they incorporate client auth methods.

Thanks
John B.

> On Aug 7, 2017, at 11:17 AM, Vladimir Dzhuvinov <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Wed, 23 Aug 2017 05:15:05 -0600

Yeah, we definitely didn't intend for it to be exclusive to the token
endpoint. I think the text kinda came out that way as an artifact of the
way some of these specs are layered and when they were written as well as
some assumptions on my part that it would be understood that this client
authentication could be applicable to the other places OAuth client
authentication is used. We will clarify things in the next draft.

On Mon, Aug 7, 2017 at 10:28 AM, John Bradley <[email-masked]> wrote:

> Good point,  I don’t think we intended it to be exclusive to the token
> endpoint.  It is another client auth method and should work those other
> places as well.   I will need to look at the other specs to see how they
> incorporate client auth methods.
>
> Thanks
> John B.
>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*