-
Notifications
You must be signed in to change notification settings - Fork 3
Description
The text in https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00#name-changes-in-client-keys suggests that a change in the content of the jwks_uri might indicate a condition that would need some kind of remediation or proactive disruption of something.
However the key rotation dance in OIDC at https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys and https://openid.net/specs/openid-connect-core-1_0.html#RotateEncKeys has the possibility of changes in the content of the jwks_uri as a normal course of events. And while that is in OIDC and this isn't OIDC, the pattern has permeated into the OAuth sphere. I think that if some of the actions from https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00#name-changes-in-client-keys were taken, it would be detrimental to interop.
Can this draft tone down the suggestions in Changes in Client Keys?