OAuth2: What is the difference between the JWT Authorization Grant and Client Credentials Grant with JWT client authentication?

A slightly different perspective on the great answer by Josh C: as it happens both the client authentication and the grant credentials can be expressed as JWTs but the semantics behind them are different.

It is about separation of concerns: clients authenticate with a credential that identifies them i.e. they are the so-called subject whereas they use grants that were issued to them i.e. they are the so-called audience. Or as version 12 of the draft spec (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer-12) says:

  1. The JWT MUST contain a “sub” (subject) claim identifying the
    principal that is the subject of the JWT. Two cases need to be
    differentiated:

    A. For the authorization grant, the subject typically
    identifies an authorized accessor for which the access token
    is being requested (i.e., the resource owner or an
    authorized delegate), but in some cases, may be a
    pseudonymous identifier or other value denoting an anonymous
    user.

    B. For client authentication, the subject MUST be the
    “client_id” of the OAuth client.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)