Recommend RFC 7591 as a fallback for client registration #7

New issue

Open

opened 2024-04-05 23:45:36 +02:00 by evanp · 1 comment

evanp commented

2024-04-05 23:45:36 +02:00

Owner

RFC 7591 is a mechanism for dynamically registering a client with an OAuth server.

It can be recommended as another kind of client ID to use.

This might be a good algorithm: if a registration endpoint is discoverable, use that. Otherwise, use the global client ID mechanism.

[RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591) is a mechanism for dynamically registering a client with an OAuth server. It can be recommended as another kind of client ID to use. This might be a good algorithm: if a registration endpoint is discoverable, use that. Otherwise, use the global client ID mechanism.

evanp added the

FEP-d8c2

label

2024-04-05 23:45:51 +02:00

thisismissem commented

2024-04-06 23:46:41 +02:00

To achieve something similar to what you've outlined in your FEP draft, it'd be possible to do dynamic client registration with a URI for the Client ID values, essentially saying "go grab my client details from here", that's essentially what Solid's OIDC extension does: https://solidproject.org/TR/oidc#clientids-document

I think it'd be possible to do the same with OAuth 2.0, instead of OIDC — they're approximately similar as far as protocols go.