Deployment models, Transaction Tokens and Discovery

[gffletch]

Another topic discussed in the IETF 121 OAuth meetings is the discovery of the token issuing service (Transaction Token Service) and whether different deployment models affect discovery or token issuance in any way.

Three possible deployment models (NOT exhaustive):

1. Embedded in an Authorization Server, or API GW
2. Single HA Transaction Token Service
3. Distributed (geographically) Transaction Token Service

How does a client of the Transaction Token Service endpoint know where to go? Is this out-of-scope for any specifications and the security concern of a client sending a transaction token request to an incorrect (unauthorized) endpoint should just be clearly called out in the security considerations.

The thinking from the OAuth meeting is that this topic should be discussed in WIMSE as well.

OAuth Transaction Tokens github repository.