OIDC: scoped sub with client_credentials?

[Scott Cantor]

I'm going mostly from memory and the docs I wrote as I don't have time to look at the code today, but IIRC, the sub claim in the client_credentials grant is pretty specifically "the client", i.e. not a "user".

It comes from the canonicalized name of the client after it passes through the client authentication flow, so you get a subject c14n step in there as with normal authentication, so it's possible to transform it, but otherwise it's basically the client_id.

It is, IIRC, not at all coming from the resolver the way it normally does.

That's from memory and my memory is probably faulty, but the docs at least say some of that.

I don't know whether it's even possible to override it other than through subject c14n transformation.

And obviously, a scoped client_id is possible but not typical. For us, client_ids should always be URIs and for the rest of the world, they're just non-unique strings. Scoping them isn't crazy, but it would have to probably come from the c14n step at this point.

-- Scott