request_object_signing_alg says 'MAY' when I think it means 'MUST'

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2026-02-25

https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata says, for request_object_signing_alg:

"The default, if omitted, is that any algorithm supported by the OP and the RP MAY be used."

I'm struggling to figure out the "MAY". I think it means the RP needs to use an alg that it supports, and that the OP supports. But I'm struggling because I think that would make more sense if it said MUST:

"The default, if omitted, is that any algorithm supported by the OP and the RP MUST be used."

After talking to MikeJ he did say the intended reading is a 'MUST', i.e. do what will actually work.

We might want to tighten up the wording in an errata. It many of the default DCR cases it doesn't matter too much, but when using Federation automatic registration it matters more (this case up because the certification tests for federation don't include request_object_signing_alg when testing automatic registration).

---

Bitbucket status: new

Bitbucket origin: issue 2188

[bitbucket-import-issues]

Originally submitted by Frederik Krogsdal Jacobsen (Frederik Krogsdal Jacobsen) on 2026-02-27

I think the problem is that the existing text is really mixing two different things.
It's trying to say something like:

1. The RP MUST use a value that is supported by both the OP and the RP.
2. If the value is omitted, the RP MAY use any value that is supported by both the OP and the RP.

The second part is not really a requirement, since it just says that the OP MUST support any algorithm that the OP supports. (I.e., it doesn't really say anything at all.)

I think the wording could be improved by focusing on the actual requirement:

If this value is omitted, the RP MUST use an algorithm that is supported by both the OP and the RP.