Docs on client_credentials grant support

[Cantor, Scott]

On 2/24/22, 6:03 AM, "dev on behalf of Philip Smart via dev" <dev-bounces at shibboleth.net on behalf of dev at shibboleth.net> wrote:

>    So (for my understanding) this means by default the resources servers would need to be registered, and any
> you want to allow unregistered would require an override which disables encryption? So for either type you
> need some form of registration even if basic.

The unregistered use case is handled by enabling a profile (OAUTH2.TokenAudience in this case) in the UnverifiedRelyingParty bean, so it's just one time, but you currently also have to set p:encryptionOptional="true" in that bean as an extra step because it will never work otherwise.

That's the part that I find somewhat awkward, despite agreeing that I prefer the default logically to be false. OTOH it also is somewhat more visible as an outcome that way too.

-- Scott