Subject: [OAUTH-WG] draft-ietf-oauth-mtls-03: enforcing mutual_tls_sender_constrained_access_tokens

From: Vladimir Dzhuvinov <[email-masked]>
Date: Sun, 27 Aug 2017 10:46:57 +0300

Let's suppose that an OAuth 2.0 client is registered for

mutual_tls_sender_constrained_access_tokens=true

Is it correct that in the presence of this parameter, and regardless of
how "token_endpoint_auth_method" is set, the AS must require a client
X.509 cert to be passed to the token endpoint? If yes, then what error
should the AS return if no client cert is passed with the token request?

https://tools.ietf.org/html/rfc6749#section-5.2

Thanks,

Vladimir

PS: Noticed a typo - "manor" in #section-4.3

---

From: Brian Campbell <[email-masked]>
Date: Mon, 28 Aug 2017 09:53:47 -0600

"invalid_client" is the appropriate error, if the client is
configured/registered for MTLS authentication, because it's effectively
failed client authentication.

I would say that "invalid_request" is probably the appropriate error for a
public client with mutual_tls_sender_constrained_access_tokens=true that
doesn't provide the TLS client certificate with the token request. There is
effectively a missing required parameter in the context of the request.

On Sun, Aug 27, 2017 at 1:46 AM, Vladimir Dzhuvinov <[email-masked]
> wrote:

> how "token_endpoint_auth_method" is set, the AS must require a client X.509
> cert to be passed to the token endpoint? If yes, then what error should the
> AS return if no client cert is passed with the token request?
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Tue, 29 Aug 2017 09:53:01 +0300

> effectively a missing required parameter in the context of the request.
Thanks, "invalid_request" does indeed look like the best fit to signal
the request is incomplete (missing TLS client cert).

Vladimir

-- 
Vladimir Dzhuvinov :: [email-masked]