openid / OpenID4VCI

68 stars 20 forks source link

Token request example with no client auth is missing `client_id` #338

Closed awoie closed 5 months ago

awoie commented 5 months ago

RFC 6749 requires client_id in the token request if the client is not authenticated:

client_id REQUIRED, if the client is not authenticating with the authorization server as described in Section 3.2.1.

The pre-authz code example does not use client authentication and is therefore missing a client_id:

Below is a non-normative example of a Token Request in a Pre-Authorized Code Flow (without Client Authentication):

POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code &pre-authorized_code=SplxlOBeZQQYbYS6WxSbIA &tx_code=493536

The example should probably have to be fixed to include a client_id parameter (although it is pretty useless for pre-authz; more useful for code flow).

awoie commented 5 months ago

Closing issue since for pre-authz code this is not required if authorized_grant_anonymous_access_supported is set to true (default is false).