Additional detail on 'aud' claim #141
Conversation
See issue #134
| * `grant_type` REQUIRED. The value MUST be set to `urn:ietf:params:oauth:grant-type:token-exchange` | ||
| * `audience` REQUIRED. The value MUST be set to the Trust Domain name | ||
| * `grant_type` REQUIRED. The value MUST be set to `urn:ietf:params:oauth:grant-type:token-exchange`. | ||
| * `audience` REQUIRED. The value of the aud claim MUST remain unchanged in a replacement Txn-Token to prevent the Txn-Token from being accepted outside it's current Trust Domain. |
There was a problem hiding this comment.
This is in the "Txn-Token Request" section. Do we need to talk about replacement here, or should we have that language in the "Creating Replacement Txn-Tokens" section? We perhaps already have this there. Also, if you delete the "value MUST be set to the Trust Domain name", then we don't have that constraint listed anywhere else. We should make sure we have that specified somewhere if we want to remove it from here.
There was a problem hiding this comment.
When the aud claim is initially defined, it is constrained to the trust domain. Agreed this is in the wrong section. Thanks for catching that. Reading the section on the replacement transaction tokens, it states that the sub and and values must remain unchanged. It may be enough to have the constraint explained in the original definition, so just removing this.,
See issue #134