request a scope equal to or less than the scope originally granted to the authorized accessor.

Condition: when exchanging an assertion for an access token and requesting scope

"the requested scope MUST be equal to or less than the scope originally granted"

include a `grant_type` parameter containing the assertion format defined by the authorization server as an absolute URI.

Condition: when using an assertion as an authorization grant

`grant_type` is "REQUIRED" and its value is an absolute URI.

include the `assertion` parameter containing the assertion used as the authorization grant.

Condition: when using an assertion as an authorization grant

`assertion` is "REQUIRED. The assertion being used as an authorization grant."

include a `scope` parameter specifying the requested scope.

Condition: when using an assertion as an authorization grant

`scope` is "OPTIONAL."

limit the issued access token's scope to be equal to or less than the scope originally granted to the authorized accessor.

Condition: when exchanging an assertion for an access token

"The authorization server MUST limit the scope of the issued access token"

set the error response's `error` parameter to `invalid_grant`.

Condition: if the assertion is invalid or expired

"The value of the \"error\" parameter MUST be the \"invalid_grant\" error code."

reject an assertion that does not identify it as the intended audience.

Condition: if its identity is absent from the assertion's intended audience

"The authorization server MUST reject any assertion that does not contain its own identity as the intended audience."

reject expired assertions, subject to allowable clock skew between systems.

Condition: if the assertion has expired

"The authorization server MUST reject assertions that have expired"

reject assertions with an invalid signature or MAC.

Condition: if the assertion's signature or MAC is invalid

"The authorization server MUST reject assertions with an invalid signature or MAC."

issue an access token whose lifetime significantly exceeds the assertion's validity period.

Condition: when issuing an access token from an assertion grant

"authorization servers SHOULD NOT issue access tokens with a lifetime that exceeds the validity period of the assertion by a significant period"

include additional information about why the assertion was considered invalid using `error_description` or `error_uri`.

Condition: if the assertion is invalid or expired

"The authorization server MAY include additional information" using `error_description` or `error_uri`.

contain an Issuer.

"The assertion MUST contain an Issuer."

use the client's `client_id` as the Issuer.

Condition: if the assertion is self-issued

"the Issuer MUST be the value of the client's \"client_id\""

contain a Subject.

"The assertion MUST contain a Subject."

use the client's `client_id` as the Subject.

Condition: when the client is acting on behalf of itself

"the Subject MUST be the value of the client's \"client_id\""

contain an Audience identifying the authorization server as the intended audience.

"The assertion MUST contain an Audience that identifies the authorization server as the intended audience."

contain an Expires At entity limiting the time window in which it can be used.

"The assertion MUST contain an Expires At entity"

contain an Issued At entity specifying its UTC issuance time.

"The assertion MAY contain an Issued At entity containing the UTC time"