In https://issues.redhat.com/browse/THREESCALE-11015 we introduce 2 new method to inspect token. Using

• private_key_jwt
• client_secret_jwt

When using client_secret_jwt, we signed token with RS256 algorithm, however with recent work done for https://issues.redhat.com/browse/THREESCALE-11474 we can now also sign the token with ES256.

This is also the requirement for FAPI advance profile

For JWS, both clients and authorization servers

* shall use PS256 or ES256 algorithms;

* should not use algorithms that use RSASSA-PKCS1-v1_5 (e.g. RS256); and

* shall not use none.