Is client authentication on the PAR endpoint allowed with the JAR request object

[brockallen]

Hmm, sorry for the long subject line, but I guess that's why whole question: On the PAR endpoint, can the JAR request object signature be used for client authentication in lieu of other client authentication parameters (e.g. private key JWT)?

I'd wonder if the answer is "no" because there might be some replay style attack with request objects obtained when used as parameters to the authorize endpoint from other client requests. As I was re-reading section 3 this was one of the first thoughts that popped into my head.

It might be good to have a clarification somewhere. TIA

[panva]

This was the case with the preceding FAPI WG work. We have removed that option to keep the number of knobs down to a minimum.

[brockallen]

This was the case with the preceding FAPI WG work

Just for clarification, you're saying that "yes it is allowed"? Thx.

[panva]

I'm saying that, no, it isn't allowed to omit client authentication on the account of using a signed request object. We had that as an option in an early draft and removed it.

[brockallen]

Ok, thanks for the clarification!