"Dynamic" OAUTH2.TokenAudience accessTokenType?

[Simon Lundström]

Hey all,

I love how well rubberducking works but I’ll ask anyway if nothing else to make it more searchable and visible (but sorry for the noise).

To be able to support different OIDC “settings” per RP e.g:
* using JWT accessTokenType for OAUTH2.TokenAudience by default but have some RPs use opaque tokens
* forcing PKCE and DPoP as a secure default but disable it on some RPs that are less capable

one can only use MetadataDrivenConfiguration right?

There are no other ways to support this use case (short of extending the IDP that is)?

Also MDDriven is first matching wins right? So the MDDriven overrides first and then the secure default in relying-party.xml?

Thanks!

BR,
- Simon