Token endpoint to return an access token with the aud claim when using client credentials by default even when client is NOT passing audience parameter

[sagarshah1983]

Hello everyone,
Could we have an enhancement in the token endpoint w.r.t. client credentials flow that returns anaud claim in the token even when client does not pass audience claim with the value that client originally was registered with?

Meaning, if a client was registered with audience as "https://api.example.com", then can we return the aud claim in the token as "https://api.example.com" even when client does not pass audience in the /token endpoint request?
Will this be against the Auth 2 / Open ID specs?

Appreciate your suggestions!

Regards,
Sagar Shah

[aeneasr]

To be honest, I am not sure! Have you found any other systems that behave like this?

[sagarshah1983]

I think, I found something similar. This ticket probably is a duplicate ticket to this #1748 OR #1383
We need a way to set a claim in the aud token, while the tickets I referred could be generic to include any other claims as well.

[aeneasr]

Yeah, those would definitely help with your issue if they were implemented!