DPoP proof: support the "ath" claim

1 files changed, 216 insertions, 197 deletions

diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot
index ad294e9..5651551 100644
--- a/po/webid-oidc.pot
+++ b/po/webid-oidc.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-07-08 00:38+0200\n"
+"POT-Creation-Date: 2021-07-22 11:08+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -122,683 +122,702 @@ msgstr ""
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1064
+#: src/scm/webid-oidc/errors.scm:1090
 msgid "that’s how it is"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1069
+#: src/scm/webid-oidc/errors.scm:1095
 #, scheme-format
 msgid "the value ~s is not a base64 string (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1072
+#: src/scm/webid-oidc/errors.scm:1098
 #, scheme-format
 msgid "the value ~s is not JSON (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1075
+#: src/scm/webid-oidc/errors.scm:1101
 #, scheme-format
 msgid "the value ~s is not Turtle (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1078
+#: src/scm/webid-oidc/errors.scm:1104
 #, scheme-format
 msgid "the value ~s does not identify an elleptic curve"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1083
+#: src/scm/webid-oidc/errors.scm:1109
 #, scheme-format
 msgid "the value ~s does not identify a JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1085
+#: src/scm/webid-oidc/errors.scm:1111
 #, scheme-format
 msgid "the value ~s does not identify a JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1090
+#: src/scm/webid-oidc/errors.scm:1116
 #, scheme-format
 msgid "the value ~s does not identify a public JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1092
+#: src/scm/webid-oidc/errors.scm:1118
 #, scheme-format
 msgid "the value ~s does not identify a public JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1097
+#: src/scm/webid-oidc/errors.scm:1123
 #, scheme-format
 msgid "the value ~s does not identify a private JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1099
+#: src/scm/webid-oidc/errors.scm:1125
 #, scheme-format
 msgid "the value ~s does not identify a private JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1104
+#: src/scm/webid-oidc/errors.scm:1130
 #, scheme-format
 msgid "the value ~s does not identify a JWKS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1106
+#: src/scm/webid-oidc/errors.scm:1132
 #, scheme-format
 msgid "the value ~s does not identify a JWKS"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1109
+#: src/scm/webid-oidc/errors.scm:1135
 #, scheme-format
 msgid "the value ~s does not identify a hash algorithm"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1112
+#: src/scm/webid-oidc/errors.scm:1138
 #, scheme-format
 msgid "the value ~s is not an alist or misses key ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1115
+#: src/scm/webid-oidc/errors.scm:1141
 #, scheme-format
 msgid "the value ~s is not a JWS header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1118
+#: src/scm/webid-oidc/errors.scm:1144
 #, scheme-format
 msgid "the value ~s is not a JWS payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1121
+#: src/scm/webid-oidc/errors.scm:1147
 #, scheme-format
 msgid "the value ~s is not a JWS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1124
+#: src/scm/webid-oidc/errors.scm:1150
 #, scheme-format
 msgid "the string ~s cannot be split in 3 parts with ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1127
+#: src/scm/webid-oidc/errors.scm:1153
 #, scheme-format
 msgid ""
 "all key candidates failed to verify signature ~s with algorithm ~s and "
 "payload ~a (there were ~a: ~s)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1130
+#: src/scm/webid-oidc/errors.scm:1156
 #, scheme-format
 msgid "I cannot decode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1133
+#: src/scm/webid-oidc/errors.scm:1159
 #, scheme-format
 msgid "I cannot encode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1136
+#: src/scm/webid-oidc/errors.scm:1162
 #, scheme-format
 msgid ""
 "the server request unexpectedly failed with code ~a and reason phrase ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1141
+#: src/scm/webid-oidc/errors.scm:1167
 #, scheme-format
 msgid "the header ~a should not have the value ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1143
+#: src/scm/webid-oidc/errors.scm:1169
 #, scheme-format
 msgid "the header ~a should be present"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1146
+#: src/scm/webid-oidc/errors.scm:1172
 #, scheme-format
 msgid "the server response wasn't expected: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1152
+#: src/scm/webid-oidc/errors.scm:1178
 #, scheme-format
 msgid "the value ~s is not an OIDC configuration (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1157
+#: src/scm/webid-oidc/errors.scm:1183
 #, scheme-format
 msgid "the webid field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1158
+#: src/scm/webid-oidc/errors.scm:1184
 msgid "the webid field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1162
+#: src/scm/webid-oidc/errors.scm:1188
 #, scheme-format
 msgid "the sub field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1163
+#: src/scm/webid-oidc/errors.scm:1189
 msgid "the sub field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1167
+#: src/scm/webid-oidc/errors.scm:1193
 #, scheme-format
 msgid "the iss field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1168
+#: src/scm/webid-oidc/errors.scm:1194
 msgid "the iss field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1172
+#: src/scm/webid-oidc/errors.scm:1198
 #, scheme-format
 msgid "the aud field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1173
+#: src/scm/webid-oidc/errors.scm:1199
 msgid "the aud field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1177
+#: src/scm/webid-oidc/errors.scm:1203
 #, scheme-format
 msgid "the iat field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1178
+#: src/scm/webid-oidc/errors.scm:1204
 msgid "the iat field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1182
+#: src/scm/webid-oidc/errors.scm:1208
 #, scheme-format
 msgid "the exp field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1183
+#: src/scm/webid-oidc/errors.scm:1209
 msgid "the exp field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1187
+#: src/scm/webid-oidc/errors.scm:1213
 #, scheme-format
 msgid "the cnf/jkt field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1188
+#: src/scm/webid-oidc/errors.scm:1214
 msgid "the cnf/jkt field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1192
+#: src/scm/webid-oidc/errors.scm:1218
 #, scheme-format
 msgid "the client-id field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1193
+#: src/scm/webid-oidc/errors.scm:1219
 msgid "the client-id field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1197
+#: src/scm/webid-oidc/errors.scm:1223
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:149
 #, scheme-format
 msgid "the redirect_uris field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1198
+#: src/scm/webid-oidc/errors.scm:1224
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:150
 msgid "the redirect_uris field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1202
+#: src/scm/webid-oidc/errors.scm:1228
 #, scheme-format
 msgid "the typ field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1203
+#: src/scm/webid-oidc/errors.scm:1229
 msgid "the typ field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1207
+#: src/scm/webid-oidc/errors.scm:1233
 #, scheme-format
 msgid "the jwk field is incorrect: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1209
+#: src/scm/webid-oidc/errors.scm:1235
 msgid "the jwk field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1213
+#: src/scm/webid-oidc/errors.scm:1239
 #, scheme-format
 msgid "the jti field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1214
+#: src/scm/webid-oidc/errors.scm:1240
 msgid "the jti field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1218
+#: src/scm/webid-oidc/errors.scm:1244
 #, scheme-format
 msgid "the nonce field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1219
+#: src/scm/webid-oidc/errors.scm:1245
 msgid "the nonce field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1223
+#: src/scm/webid-oidc/errors.scm:1249
 #, scheme-format
 msgid "the htm field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1224
+#: src/scm/webid-oidc/errors.scm:1250
 msgid "the htm field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1228
+#: src/scm/webid-oidc/errors.scm:1254
 #, scheme-format
 msgid "the htu field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1229
+#: src/scm/webid-oidc/errors.scm:1255
 msgid "the htu field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1231
+#: src/scm/webid-oidc/errors.scm:1259
+#, scheme-format
+msgid "the ath field is incorrect: ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1260
+msgid "the ath field is missing"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1262
 #, scheme-format
 msgid "~s is not an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1234
+#: src/scm/webid-oidc/errors.scm:1265
 #, scheme-format
 msgid "~s is not an access token header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1237
+#: src/scm/webid-oidc/errors.scm:1268
 #, scheme-format
 msgid "~s is not an access token payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1240
+#: src/scm/webid-oidc/errors.scm:1271
 #, scheme-format
 msgid "~s is not a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1243
+#: src/scm/webid-oidc/errors.scm:1274
 #, scheme-format
 msgid "~s is not a DPoP proof header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1246
+#: src/scm/webid-oidc/errors.scm:1277
 #, scheme-format
 msgid "~s is not a DPoP proof payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1249
+#: src/scm/webid-oidc/errors.scm:1280
 #, scheme-format
 msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1256
+#: src/scm/webid-oidc/errors.scm:1287
 #, scheme-format
 msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1267
+#: src/scm/webid-oidc/errors.scm:1298
 #, scheme-format
 msgid "the HTTP method is signed for ~s, but ~s was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1270
+#: src/scm/webid-oidc/errors.scm:1301
 #, scheme-format
 msgid "the HTTP uri is signed for ~a, but ~a was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1273
+#: src/scm/webid-oidc/errors.scm:1304
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1277
+#: src/scm/webid-oidc/errors.scm:1308
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1286
+#: src/scm/webid-oidc/errors.scm:1317
 #, scheme-format
 msgid "the key ~s does not hash to ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1288
+#: src/scm/webid-oidc/errors.scm:1319
 #, scheme-format
 msgid "the key confirmation of ~s failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1290
+#: src/scm/webid-oidc/errors.scm:1321
 #, scheme-format
 msgid "the key confirmation of ~s failed"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1292
+#: src/scm/webid-oidc/errors.scm:1326
+#, scheme-format
+msgid "the DPoP proof is bound to an access token with hash ~s, not ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1328
+#, scheme-format
+msgid "the DPoP proof should be bound to the access token ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1331
 #, scheme-format
 msgid "the jti ~s has already been found (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1295
+#: src/scm/webid-oidc/errors.scm:1334
 #, scheme-format
 msgid "I cannot decode ~s as an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1298
+#: src/scm/webid-oidc/errors.scm:1337
 #, scheme-format
 msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1301
+#: src/scm/webid-oidc/errors.scm:1340
 #, scheme-format
 msgid "I cannot decode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1304
+#: src/scm/webid-oidc/errors.scm:1343
 #, scheme-format
 msgid "I cannot encode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1307
+#: src/scm/webid-oidc/errors.scm:1346
 #, scheme-format
 msgid "I could not fetch a RDF graph at ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1310
+#: src/scm/webid-oidc/errors.scm:1349
 #, scheme-format
 msgid "~s is not a client manifest (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1313
+#: src/scm/webid-oidc/errors.scm:1352
 #, scheme-format
 msgid "~s does not authorize redirection URI ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1316
+#: src/scm/webid-oidc/errors.scm:1355
 msgid "I cannot serve a public manifest"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1318
+#: src/scm/webid-oidc/errors.scm:1357
 #, scheme-format
 msgid "~a does not have a client manifest registration triple"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1321
+#: src/scm/webid-oidc/errors.scm:1360
 #, scheme-format
 msgid "the client manifest at ~a is advertised for ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1324
+#: src/scm/webid-oidc/errors.scm:1363
 #, scheme-format
 msgid "I could not fetch the client manifest of ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1327
+#: src/scm/webid-oidc/errors.scm:1366
 #, scheme-format
 msgid "~s is not an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1330
+#: src/scm/webid-oidc/errors.scm:1369
 #, scheme-format
 msgid "~s is not an authorization code header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1333
+#: src/scm/webid-oidc/errors.scm:1372
 #, scheme-format
 msgid "~s is not an authorization code payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1336
+#: src/scm/webid-oidc/errors.scm:1375
 #, scheme-format
 msgid "the current time is ~a, and the authorization code expired at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1340
+#: src/scm/webid-oidc/errors.scm:1379
 #, scheme-format
 msgid "I cannot decode ~s as an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1343
+#: src/scm/webid-oidc/errors.scm:1382
 #, scheme-format
 msgid "I cannot encode ~s as an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1346
+#: src/scm/webid-oidc/errors.scm:1385
 #, scheme-format
 msgid "there is no such refresh token as ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1349
+#: src/scm/webid-oidc/errors.scm:1388
 #, scheme-format
 msgid ""
 "the refresh token is bound to a key confirmed as ~s, but it is used with key "
 "~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1352
+#: src/scm/webid-oidc/errors.scm:1391
 #, scheme-format
 msgid "I cannot decode ~s as an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1355
+#: src/scm/webid-oidc/errors.scm:1394
 #, scheme-format
 msgid "I cannot encode ~s as an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1358
+#: src/scm/webid-oidc/errors.scm:1397
 #, scheme-format
 msgid "the grant type ~s is not supported"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1361
+#: src/scm/webid-oidc/errors.scm:1400
 msgid "there is no authorization code in the request"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1363
+#: src/scm/webid-oidc/errors.scm:1402
 msgid "there is no refresh token in the request"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1365
+#: src/scm/webid-oidc/errors.scm:1404
 #, scheme-format
 msgid "~s is not an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1368
+#: src/scm/webid-oidc/errors.scm:1407
 #, scheme-format
 msgid "~s is not an ID token header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1371
+#: src/scm/webid-oidc/errors.scm:1410
 #, scheme-format
 msgid "~s is not an ID token payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1374
+#: src/scm/webid-oidc/errors.scm:1413
 #, scheme-format
 msgid ""
 "I couldn’t set the locale to ~s as an approximation of the client locale ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1377
+#: src/scm/webid-oidc/errors.scm:1416
 #, scheme-format
 msgid "~s does not admit ~s as an identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1380
+#: src/scm/webid-oidc/errors.scm:1419
 #, scheme-format
 msgid ""
 "~a is neither an identity provider (because ~a) nor a webid (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1385
+#: src/scm/webid-oidc/errors.scm:1424
 #, scheme-format
 msgid "the token request failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1388
+#: src/scm/webid-oidc/errors.scm:1427
 #, scheme-format
 msgid "you don’t have a refresh token for identity ~a certified by ~a in ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1393
+#: src/scm/webid-oidc/errors.scm:1432
 #, scheme-format
 msgid "all identity provider candidates for ~a failed: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1397
+#: src/scm/webid-oidc/errors.scm:1436
 #, scheme-format
 msgid "~s failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1400
+#: src/scm/webid-oidc/errors.scm:1439
 msgid ", "
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1402
+#: src/scm/webid-oidc/errors.scm:1441
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1405
+#: src/scm/webid-oidc/errors.scm:1444
 #, scheme-format
 msgid "the resource kind ~s is absent for the resource at ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1408
+#: src/scm/webid-oidc/errors.scm:1447
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s, but ~s exists"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1411
+#: src/scm/webid-oidc/errors.scm:1450
 msgid "the root storage cannot be deleted"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1413
+#: src/scm/webid-oidc/errors.scm:1452
 #, scheme-format
 msgid "the container ~s should be emptied before being deleted"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1416
+#: src/scm/webid-oidc/errors.scm:1455
 #, scheme-format
 msgid "the group ~s cannot be fetched (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1420
+#: src/scm/webid-oidc/errors.scm:1459
 #, scheme-format
 msgid "the containment triples in the request to update ~s are not up to date"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1423
+#: src/scm/webid-oidc/errors.scm:1462
 #, scheme-format
 msgid "the server cannot process resources with the ~s content-type"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1426
+#: src/scm/webid-oidc/errors.scm:1465
 #, scheme-format
 msgid ""
 "the client wants to create a resource at ~s, which is reserved for an "
 "auxiliary resource"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1429
+#: src/scm/webid-oidc/errors.scm:1468
 #, scheme-format
 msgid ""
 "the operation on ~s by ~a is refused, because it’s not by ~s and the access "
 "control forbids the following mode of operation: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1433
+#: src/scm/webid-oidc/errors.scm:1472
 msgid "an anonymous user"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1438
+#: src/scm/webid-oidc/errors.scm:1477
 #, scheme-format
 msgid ""
 "the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
 "resource has a representation of ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1440
+#: src/scm/webid-oidc/errors.scm:1479
 #, scheme-format
 msgid ""
 "the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
 "resource has no representation"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1443
+#: src/scm/webid-oidc/errors.scm:1482
 #, scheme-format
 msgid ""
 "the client wanted a response with a content type among ~s, but the resource "
 "at ~s has content-type ~s which cannot be converted to one of them"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1450
+#: src/scm/webid-oidc/errors.scm:1489
 msgid "that’s it"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1454
+#: src/scm/webid-oidc/errors.scm:1493
 #, scheme-format
 msgid "~a and ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1457
+#: src/scm/webid-oidc/errors.scm:1496
 #, scheme-format
 msgid "~a, ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1461
+#: src/scm/webid-oidc/errors.scm:1500
 #, scheme-format
 msgid "the signature ~a does not match key ~s with payload ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1464
+#: src/scm/webid-oidc/errors.scm:1503
 #, scheme-format
 msgid "the request failed unexpectedly with code ~a: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1468
+#: src/scm/webid-oidc/errors.scm:1507
 msgid "there is an undefined variable"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1470
+#: src/scm/webid-oidc/errors.scm:1509
 #, scheme-format
 msgid "the origin is ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1473
+#: src/scm/webid-oidc/errors.scm:1512
 #, scheme-format
 msgid "a message is attached: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1476
+#: src/scm/webid-oidc/errors.scm:1515
 #, scheme-format
 msgid "the values ~s are problematic"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1479
+#: src/scm/webid-oidc/errors.scm:1518
 #, scheme-format
 msgid "there is a kind (~s) and args ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1482
+#: src/scm/webid-oidc/errors.scm:1521
 msgid "there is an assertion failure"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1484
+#: src/scm/webid-oidc/errors.scm:1523
 #, scheme-format
 msgid "the program quits with code ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1487
+#: src/scm/webid-oidc/errors.scm:1526
 msgid "the program cannot recover from this exception"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1489
+#: src/scm/webid-oidc/errors.scm:1528
 msgid "there is an external error"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1491
+#: src/scm/webid-oidc/errors.scm:1530
 msgid "there is an error"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1493
+#: src/scm/webid-oidc/errors.scm:1532
 #, scheme-format
 msgid "Unhandled exception type ~a."
 msgstr ""
@@ -950,15 +969,15 @@ msgid "Warning: ~a\n"
 msgstr ""
 
 #: src/scm/webid-oidc/hello-world.scm:48 src/scm/webid-oidc/example-app.scm:116
-#: src/scm/webid-oidc/program.scm:226
+#: src/scm/webid-oidc/program.scm:204
 msgid "command-line|version"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:228
+#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:206
 msgid "command-line|complete-corresponding-source"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:230
+#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:208
 msgid "command-line|help"
 msgstr ""
 
@@ -966,11 +985,11 @@ msgstr ""
 msgid "command-line|port"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:260
+#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:238
 msgid "command-line|log-file"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:262
+#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:240
 msgid "command-line|error-file"
 msgstr ""
 
@@ -1004,12 +1023,12 @@ msgid ""
 msgstr ""
 
 #: src/scm/webid-oidc/hello-world.scm:103
-#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:516
+#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:494
 #, scheme-format
 msgid "~a version ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:524
+#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:502
 msgid ""
 "You are legally required to link to the complete corresponding source code.\n"
 msgstr ""
@@ -1128,95 +1147,95 @@ msgstr ""
 msgid "There was an error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:122
+#: src/scm/webid-oidc/program.scm:98
 #, scheme-format
 msgid "~a: ~a: Internal server error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:136
+#: src/scm/webid-oidc/program.scm:112
 #, scheme-format
 msgid ""
 "The client locale ~s can’t be approximated by system locale ~s (because ~a), "
 "using C.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:160
+#: src/scm/webid-oidc/program.scm:136
 #, scheme-format
 msgid "~a: ~s ~a ~s ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:162
+#: src/scm/webid-oidc/program.scm:138
 #, scheme-format
 msgid "~a: ~a (~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:166
+#: src/scm/webid-oidc/program.scm:142
 #, scheme-format
 msgid "~a: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:176
+#: src/scm/webid-oidc/program.scm:152
 #, scheme-format
 msgid "(there was an error: ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:232
+#: src/scm/webid-oidc/program.scm:210
 msgid "command-line|server|port"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:234
+#: src/scm/webid-oidc/program.scm:212
 msgid "command-line|server|server-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:236
+#: src/scm/webid-oidc/program.scm:214
 msgid "command-line|server|reverse-proxy|backend-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:238
+#: src/scm/webid-oidc/program.scm:216
 msgid "command-line|server|reverse-proxy|header"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:240
+#: src/scm/webid-oidc/program.scm:218
 msgid "command-line|server|issuer|key-file"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:242
+#: src/scm/webid-oidc/program.scm:220
 msgid "command-line|server|issuer|subject"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:244
+#: src/scm/webid-oidc/program.scm:222
 msgid "command-line|server|issuer|encrypted-password"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:246
+#: src/scm/webid-oidc/program.scm:224
 msgid "command-line|server|issuer|jwks-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:248
+#: src/scm/webid-oidc/program.scm:226
 msgid "command-line|server|issuer|authorization-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:250
+#: src/scm/webid-oidc/program.scm:228
 msgid "command-line|server|issuer|token-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:252
+#: src/scm/webid-oidc/program.scm:230
 msgid "command-line|server|client-id"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:254
+#: src/scm/webid-oidc/program.scm:232
 msgid "command-line|server|redirect-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:256
+#: src/scm/webid-oidc/program.scm:234
 msgid "command-line|server|client-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:258
+#: src/scm/webid-oidc/program.scm:236
 msgid "command-line|server|client-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:287
+#: src/scm/webid-oidc/program.scm:265
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
@@ -1371,127 +1390,127 @@ msgid ""
 "If you find a bug, then please send a report to ~a.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:437 src/scm/webid-oidc/program.scm:495
-#: src/scm/webid-oidc/program.scm:597
+#: src/scm/webid-oidc/program.scm:415 src/scm/webid-oidc/program.scm:473
+#: src/scm/webid-oidc/program.scm:575
 msgid "command-line|command|reverse-proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:438 src/scm/webid-oidc/program.scm:502
-#: src/scm/webid-oidc/program.scm:621
+#: src/scm/webid-oidc/program.scm:416 src/scm/webid-oidc/program.scm:480
+#: src/scm/webid-oidc/program.scm:597
 msgid "command-line|command|identity-provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:439 src/scm/webid-oidc/program.scm:509
-#: src/scm/webid-oidc/program.scm:667
+#: src/scm/webid-oidc/program.scm:417 src/scm/webid-oidc/program.scm:487
+#: src/scm/webid-oidc/program.scm:641
 msgid "command-line|command|client-service"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:440 src/scm/webid-oidc/program.scm:696
+#: src/scm/webid-oidc/program.scm:418 src/scm/webid-oidc/program.scm:670
 msgid "command-line|command|server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:476 src/scm/webid-oidc/program.scm:480
-#: src/scm/webid-oidc/program.scm:484 src/scm/webid-oidc/program.scm:488
+#: src/scm/webid-oidc/program.scm:454 src/scm/webid-oidc/program.scm:458
+#: src/scm/webid-oidc/program.scm:462 src/scm/webid-oidc/program.scm:466
 #, scheme-format
 msgid "an environment variable| It is currently set to ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:478 src/scm/webid-oidc/program.scm:482
-#: src/scm/webid-oidc/program.scm:486 src/scm/webid-oidc/program.scm:490
+#: src/scm/webid-oidc/program.scm:456 src/scm/webid-oidc/program.scm:460
+#: src/scm/webid-oidc/program.scm:464 src/scm/webid-oidc/program.scm:468
 msgid "an environment variable| It is currently unset."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:531
+#: src/scm/webid-oidc/program.scm:509
 #, scheme-format
 msgid "The --~a argument must be a number, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:537
+#: src/scm/webid-oidc/program.scm:515
 #, scheme-format
 msgid "The --~a argument must be an integer, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:543
+#: src/scm/webid-oidc/program.scm:521
 #, scheme-format
 msgid "The --~a argument must be positive, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:548
+#: src/scm/webid-oidc/program.scm:526
 #, scheme-format
 msgid "The --~a argument must be less than 65536, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:590
+#: src/scm/webid-oidc/program.scm:568
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
 "See --~a (-h).\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:600 src/scm/webid-oidc/program.scm:624
-#: src/scm/webid-oidc/program.scm:698
+#: src/scm/webid-oidc/program.scm:578 src/scm/webid-oidc/program.scm:600
+#: src/scm/webid-oidc/program.scm:672
 #, scheme-format
 msgid "You must pass --~a to set the server name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:604
+#: src/scm/webid-oidc/program.scm:582
 #, scheme-format
 msgid "You must pass --~a to set the backend URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:628 src/scm/webid-oidc/program.scm:702
+#: src/scm/webid-oidc/program.scm:604 src/scm/webid-oidc/program.scm:676
 #, scheme-format
 msgid ""
 "You must pass --~a to set the file where to store the identity provider "
 "key.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:632 src/scm/webid-oidc/program.scm:706
+#: src/scm/webid-oidc/program.scm:608 src/scm/webid-oidc/program.scm:680
 #, scheme-format
 msgid "You must pass --~a to set the subject of the identity provider.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:636 src/scm/webid-oidc/program.scm:710
+#: src/scm/webid-oidc/program.scm:612 src/scm/webid-oidc/program.scm:684
 #, scheme-format
 msgid "You must pass --~a to set the subject’s encrypted password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:640 src/scm/webid-oidc/program.scm:714
+#: src/scm/webid-oidc/program.scm:616 src/scm/webid-oidc/program.scm:688
 #, scheme-format
 msgid "You must pass --~a to set the JWKS URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:644 src/scm/webid-oidc/program.scm:718
+#: src/scm/webid-oidc/program.scm:620 src/scm/webid-oidc/program.scm:692
 #, scheme-format
 msgid "You must pass --~a to set the authorization endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:648 src/scm/webid-oidc/program.scm:722
+#: src/scm/webid-oidc/program.scm:624 src/scm/webid-oidc/program.scm:696
 #, scheme-format
 msgid "You must pass --~a to set the token endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:670
+#: src/scm/webid-oidc/program.scm:644
 #, scheme-format
 msgid "You must pass --~a to set the application web ID.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:674
+#: src/scm/webid-oidc/program.scm:648
 #, scheme-format
 msgid "You must pass --~a to set the redirection URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:678
+#: src/scm/webid-oidc/program.scm:652
 #, scheme-format
 msgid "You must pass --~a to set the informative client name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:682
+#: src/scm/webid-oidc/program.scm:656
 #, scheme-format
 msgid "You must pass --~a to set the informative client URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:773
+#: src/scm/webid-oidc/program.scm:743
 #, scheme-format
 msgid "Unknown command ~s\n"
 msgstr ""