openid
Clarification to mandatory use of client_id
The client_id is said to be mandatory (section "5.2. Existing Parameters"), yet Appendix "A.2. Request" mentions it MUST be omitted in unsigned requests without giving any further information. This appears contradictory.
Section "5.9.3. Defined Client Identifier Prefixes" defines origin as an option for the client identifier prefix, yet the first bullet point in "A.5. Security Considerations" seems to hint at the client_id being removed.
This wording should be clearer to avoid confusion. One example would be to reference Appendix A directly in "5.9.3. Defined Client Identifier Prefixes" and define all DC API specifics there.
@101Coder101 Thanks for raising these issues! To use your suggestions we need to confirm if you've signed an OIDF contribution agreement ( https://openid.net/intellectual-property/openid-foundation-contribution-agreements/ ) - could you drop an email to chairs at openid-specs-digital-credentials-protocols-owner@lists.openid.net referencing this issue please?
@101Coder101 Thanks for raising these issues! To use your suggestions we need to confirm if you've signed an OIDF contribution agreement ( https://openid.net/intellectual-property/openid-foundation-contribution-agreements/ ) - could you drop an email to chairs at openid-specs-digital-credentials-protocols-owner@lists.openid.net referencing this issue please?
@jogu I have just sent an email as a confirmation.
Great, thanks @101Coder101 - I confirmed we have a contribution agreement so we're all good.
The
client_idis said to be mandatory (section "5.2. Existing Parameters"), yet Appendix "A.2. Request" mentions it MUST be omitted in unsigned requests without giving any further information. This appears contradictory.
A.2 is separate and fully self-contained. 5.2 does not apply to A.2 unless referenced by A.2 directly which is not the case.
Section "5.9.3. Defined Client Identifier Prefixes" defines
originas an option for the client identifier prefix, yet the first bullet point in "A.5. Security Considerations" seems to hint at the client_id being removed.
See answer above.
This wording should be clearer to avoid confusion. One example would be to reference Appendix A directly in "5.9.3. Defined Client Identifier Prefixes" and define all DC API specifics there.
See answer above. We chose the other way around. We reference sections from the main part of the spec (i.e. redirect-based invocation) within Annex A.
Does this make sense?
