client_id optional in the request body

[Sakurann]

OAuth2 chapter 4.1.3 Access Token Request says:

client_id
REQUIRED, if the client is not authenticating with the
authorization server as described in Section 3.2.1.

but then client assertion drafts make client_id optional https://datatracker.ietf.org/doc/html/rfc7521

Would you agree that client_id should be optional in this draft, too?

[c2bo]

This draft doesn't directly use the assertion framework anymore, but I think the idea (to not require client_id) makes sense here as well. This would basically mean this?

• if client_id exists, then
  • Attestation sub MUST be equal to client_id
  • Attestation PoP iss MUST be equal to client_id
• otherwise client_id is implicit and
  • Attestation sub MUST be equal to Attestation PoP iss