OIDC client authentication issue

[Scott Cantor]

> Is the RP supposed to tell the server which method he is using, or is
> the OP supposed to adapt itself to whatever method is actually used ?

Yes to the former, and definitely not to the latter. You have to configure the security features you want to allow, generally with profile configuration settings, but we also assume that whatever registration metadata is used will be accurate, and both have to permit something.

-- Scott