Another client type "credentialed", in addition to "public" and "confidential". The concept is being explained by Aaron (@aaronpk) in #osw2020. The OAuth 2.1 Authorization Framework tools.ietf.org/html/draft-paโ€ฆ
1
5
10
How do you find the new "credentialed" term? Been wondering if a better name could be given to this in-between class of clients
2
Suggestions welcome, but I like that it's pretty descriptive: "credentialed clients are clients that have credentials"
1
I can imagine a lot of thought was already spent on this :) Is a public client which uses a client certificate solely for the purpose of obtaining a private key bound token considered credentialed?
1
Replying to @dzhuvi @darutk
The text in the spec is "Clients that have credentials and their identity has been not been confirmed by the AS are designated as 'credentialed clients'", so that includes dynamic registration or the client bringing its own certificate, so yes :-)

Jul 22, 2020 ยท 4:46 PM UTC
1