{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1067","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1067/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1067/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1067/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1067","id":60821879,"number":1067,"title":"Need to not enforce client authentication during custom grant (JWT Bearer Assertion)","user":{"login":"khaledh","id":2148408,"avatar_url":"https://avatars.githubusercontent.com/u/2148408?v=3","gravatar_id":"","url":"https://api.github.com/users/khaledh","html_url":"https://github.com/khaledh","followers_url":"https://api.github.com/users/khaledh/followers","following_url":"https://api.github.com/users/khaledh/following{/other_user}","gists_url":"https://api.github.com/users/khaledh/gists{/gist_id}","starred_url":"https://api.github.com/users/khaledh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/khaledh/subscriptions","organizations_url":"https://api.github.com/users/khaledh/orgs","repos_url":"https://api.github.com/users/khaledh/repos","events_url":"https://api.github.com/users/khaledh/events{/privacy}","received_events_url":"https://api.github.com/users/khaledh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-03-12T13:55:02Z","updated_at":"2015-03-17T19:57:30Z","closed_at":null,"body":"We're implementing the JWT Bearer assertion authorization grant as defined in [draft-ietf-oauth-jwt-bearer](https://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer) using a custom grant in IdSrv3. Our scenario does not enforce client authentication in this grant, which is optional according to section 2.1 of the jwt bearer spec:\r\n\r\n    Authentication of the client is optional, as described in\r\n    Section 3.2.1 of OAuth 2.0 [RFC6749] and consequently, the\r\n    \"client_id\" is only needed when a form of client authentication that\r\n    relies on the parameter is used.\r\n    \r\n    The following example demonstrates an Access Token Request with a JWT\r\n    as an authorization grant (with extra line breaks for display\r\n    purposes only):\r\n    \r\n    POST /token.oauth2 HTTP/1.1\r\n    Host: as.example.com\r\n    Content-Type: application/x-www-form-urlencoded\r\n    \r\n    grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer\r\n    &assertion=eyJhbGciOiJFUzI1NiJ9.\r\n    eyJpc3Mi[...omitted for brevity...].\r\n    J9l-ZhwP[...omitted for brevity...]\r\n\r\nSo as you see the example in the spec includes neither an `Authorization` header for Basic Auth nor the client_id/client_secret are present in the request body.\r\n\r\nUnfortunately IdSrv3 enforces client authentication on the token endpoint, which conflicts with this part of the spec, and prevents us from completing our scenario properly.\r\n\r\nAny thoughts on this?"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/82571061","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1067#issuecomment-82571061","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1067","id":82571061,"user":{"login":"khaledh","id":2148408,"avatar_url":"https://avatars.githubusercontent.com/u/2148408?v=3","gravatar_id":"","url":"https://api.github.com/users/khaledh","html_url":"https://github.com/khaledh","followers_url":"https://api.github.com/users/khaledh/followers","following_url":"https://api.github.com/users/khaledh/following{/other_user}","gists_url":"https://api.github.com/users/khaledh/gists{/gist_id}","starred_url":"https://api.github.com/users/khaledh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/khaledh/subscriptions","organizations_url":"https://api.github.com/users/khaledh/orgs","repos_url":"https://api.github.com/users/khaledh/repos","events_url":"https://api.github.com/users/khaledh/events{/privacy}","received_events_url":"https://api.github.com/users/khaledh/received_events","type":"User","site_admin":false},"created_at":"2015-03-17T19:57:30Z","updated_at":"2015-03-17T19:57:30Z","body":"Sorry to bug you again about this, but would you be open to turn `ClientValidator` into a default implementation of an `IClientValidator` interface? This would allow us to use DI to override the default behavior. It's also in line with the OAuth spec in that client password is not the only way to authenticate clients."}}