Based on the spec, To support open Dynamic Registration, the Client Registration Endpoint > SHOULD accept registration requests without OAuth 2.0 Access Tokens. These > requests MAY be rate-limited or *otherwise limited to prevent a > denial-of-service attack* on the Client Registration Endpoint. If an > Initial Access Token is required for Client registration, the Client > Registration Endpoint MUST be able to accept these Access Tokens in the > manner described in the OAuth 2.0 Bearer Token Usage [RFC6750] > specification.
So our current implementation is not entirely deviating from the specification. However, I feel it would be better if we could support the case of making the Client Registration Endpoint open if someone opts to do so (ie. remove authentication) as you have suggested. Farasath Ahamed Software Engineer, WSO2 Inc.; http://wso2.com Mobile: +94777603866 Blog: blog.farazath.com Twitter: @farazath619 <https://twitter.com/farazath619> <http://wso2.com/signature> On Fri, Sep 15, 2017 at 2:47 PM, Hasini Witharana <[email protected]> wrote: > Hi, > > In OIDC dynamic client registration, in the request header we need to send > an already existing user and the password to register a client in WSO2 > Identity server.In OIDC specification[1], It is not mandatory to send user > details to register a client. > > When running the OIDC test suite for dynamic profile, test suite does not > send any user details in the header. So we can't create any client and the > test fails. > > For that issue if any user details are not provided in the registration > request we can assign an anonymous user(*wso2*.*anonymous*.*user*) and > register the client. > > [1] - https://openid.net/specs/openid-connect-registration-1_0.html > > -- > > *Hasini Witharana* > Software Engineering Intern | WSO2 > > > *Email : [email protected] <[email protected]>* > > *Mobile : +94713850143 <+94%2071%20385%200143>[image: > http://wso2.com/signature] <http://wso2.com/signature>* >
_______________________________________________ Dev mailing list [email protected] http://wso2.org/cgi-bin/mailman/listinfo/dev
