Subject: [OAUTH-WG] draft-ietf-oauth-mtls-03: resource server error code

From: Vladimir Dzhuvinov <[email-masked]>
Date: Sun, 13 Aug 2017 18:00:55 +0300

Hello,

Implementing mTLS on the RS side raised the following question:

What error code should the RS return if the x5t#S256 bound to the access
token token doesn't match the hash of the submitted client certificate?

Here are the error codes already defined in "bearer token usage":

https://tools.ietf.org/html/rfc6750#section-3.1

Thanks,
Vladimir

---

From: Brian Campbell <[email-masked]>
Date: Wed, 23 Aug 2017 05:20:27 -0600

"invalid_token" according to the last paragraph of
https://tools.ietf.org/html/draft-ietf-oauth-mtls-03#section-3 which says
that the RS, 'MUST verify that the certificate matches the certificate
associated with the access token.  If they do not match, the resource
access attempt MUST be rejected with an error per [RFC6750] using an HTTP
401 status code and the "invalid_token" error code.'

On Sun, Aug 13, 2017 at 9:00 AM, Vladimir Dzhuvinov <[email-masked]
> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*