Problem
§Third-Party Login and the login_endpoint metadata field, on agent providers and resources, describe a flow the protocol can no longer run.
- §Login Flow has the agent or resource "create a resource token with
aud = PS URL, binding the request to its own identity" and POST it to auth_token_endpoint. A resource token is issued only after verifying a person token or an auth token, and copies ps, sub, and presented_jti from it (§Resource Token). There is nothing to copy. And only an agent, signing with an agent token, calls auth_token_endpoint. A resource cannot run this flow at all.
- The
ps query parameter lets the third party choose the PS. An agent's PS is the ps claim of its agent token. Nothing for a third party to choose.
- The section was OIDC third-party-initiated login (OpenID Connect Core 1.0 §4) carried over. Its use cases are covered elsewhere or are not protocol: a portal launching an agent for a person is agent-person binding, which the PS establishes at first interaction (§Agent-Person Binding); a PS dashboard directing a person to an agent is the agent's own UI; an agent that needs the person calls the resource's
authorization_endpoint and follows the requirement it gets back.
- No companion draft references
login_endpoint.
Proposal
Remove §Third-Party Login, its figure, and login_endpoint from Agent Provider Metadata and Resource Metadata. The login_hint, domain_hint, tenant, and prompt parameters of the auth token request stay; they serve the first interaction, where binding happens, and do not depend on this section.
Problem
§Third-Party Login and the
login_endpointmetadata field, on agent providers and resources, describe a flow the protocol can no longer run.aud= PS URL, binding the request to its own identity" and POST it toauth_token_endpoint. A resource token is issued only after verifying a person token or an auth token, and copiesps,sub, andpresented_jtifrom it (§Resource Token). There is nothing to copy. And only an agent, signing with an agent token, callsauth_token_endpoint. A resource cannot run this flow at all.psquery parameter lets the third party choose the PS. An agent's PS is thepsclaim of its agent token. Nothing for a third party to choose.authorization_endpointand follows the requirement it gets back.login_endpoint.Proposal
Remove §Third-Party Login, its figure, and
login_endpointfrom Agent Provider Metadata and Resource Metadata. Thelogin_hint,domain_hint,tenant, andpromptparameters of the auth token request stay; they serve the first interaction, where binding happens, and do not depend on this section.