MFA: Change from permission to a new concept requirement

[mickenordin]

A requirement is a restriction on a resource, an anti permission if you
will. Currently two types exist, mfa-enforced and none.

Requirements are required to be set on a resource, so that an
implementor can check requirements without having to check if the
attribute is set in the request beforehand.

Please note that the token endpoint removed in the first commit is a duplicate, so it is still in the spec :)

[glpatcern]

Nice, just a couple of comments, as well as a more general question: I'd introduce a signed requirement as well, as mentioned yesterday. After all it does not cost much - requirements are optional - but given that signatures are ALSO optional for backwards compatibility, there's a way to enforce them if needed.

[michielbdejong]

LGTM

[michielbdejong]

@mickenordin can you have a look at the comments and merge this?

[mickenordin]

Nice, just a couple of comments, as well as a more general question: I'd introduce a signed requirement as well, as mentioned yesterday. After all it does not cost much - requirements are optional - but given that signatures are ALSO optional for backwards compatibility, there's a way to enforce them if needed.

I would prefer if we add the signed requirement in a separate pr, it is not clear to me if a requirement must be accompanied by a capability. We can discuss that in the next meeting.

[glpatcern]

I would prefer if we add the signed requirement in a separate pr, it is not clear to me if a requirement must be accompanied by a capability. We can discuss that in the next meeting.

All right, and yes I believe it must - as for the mfa!