Open
Description
Our team have used this jwt client for authorization by RFC-7523. In fact, the result "assertion" of this client has claim with a "scope", but there is no field "scope" in POST request like it described in 4.1 of RFC-7521.
I mean, request must look like this
POST /token.oauth2 HTTP/1.1
Host: authz.example.net
Content-Type: application/x-www-form-urlencoded
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
&scope=test
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.
eyJpc3Mi[...omitted for brevity...].
J9l-ZhwP[...omitted for brevity...]
Metadata
Metadata
Assignees
Labels
No labels