openid
Section 2.7.1 in the CAEP Interop spec is confusing
Section 2.7.1 relates to an authorization server, which is different from an SSF Transmitter or Receiver. Therefore, the CAEP Interoperability Profile should clarify how this requirement relates to the SSF Tx and Rx.
link: https://openid.github.io/sharedsignals/openid-caep-interoperability-profile-1_0.html#name-authorization-server
I'm working on a PR for this.. I see some of the confusion.
I can't quite tell if the text is assuming that the Transmitter is action as a AS as well as a resource owner... Or if the Receiver might get an access token by out of band means.
For instance.... should this describe how the transmitter MUST behave when acting as an AS? Or how the AS (transmitter or other AS) in the flow MUST behave ?
