apr_byte_t oidc_util_json_validate_cnf(request_rec *r, json_t *jwt,
		int token_binding_policy) {
	char *tbh_str = NULL;

	oidc_debug(r, "enter: policy=%s",
			oidc_token_binding_policy2str(r->pool, token_binding_policy));

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_DISABLED)
		return TRUE;

	json_t *cnf = json_object_get(jwt, OIDC_CLAIM_CNF);
	if (cnf == NULL) {
		oidc_debug(r, "no \"%s\" claim found in the token", OIDC_CLAIM_CNF);
		goto out_err;
	}

	oidc_jose_get_string(r->pool, cnf, OIDC_CLAIM_CNF_TBH, FALSE, &tbh_str,
			NULL);
	if (tbh_str != NULL)
		return oidc_util_json_validate_cnf_tbh(r, token_binding_policy, tbh_str);

	oidc_jose_get_string(r->pool, cnf, OIDC_CLAIM_CNF_X5T_S256, FALSE, &tbh_str,
			NULL);
	if (tbh_str != NULL)
		return oidc_util_json_validate_cnf_x5t_s256(r, token_binding_policy,
				tbh_str);

	oidc_debug(r,
			" \"%s\" claim found in the token but no \"%s\" or \"%s\" key found inside",
			OIDC_CLAIM_CNF, OIDC_CLAIM_CNF_TBH, OIDC_CLAIM_CNF_X5T_S256);

out_err:

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_OPTIONAL)
		return TRUE;
	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_ENFORCED)
		return FALSE;

	// token_binding_policy == OIDC_TOKEN_BINDING_POLICY_REQUIRED
	// TODO: we don't know which token binding the client supports, do we ?
	return FALSE;
}
apr_byte_t oidc_util_json_validate_cnf(request_rec *r, json_t *jwt,
		int token_binding_policy) {
	char *tbh_str = NULL;

	oidc_debug(r, "enter: policy=%s",
			oidc_token_binding_policy2str(r->pool, token_binding_policy));

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_DISABLED)
		return TRUE;

	json_t *cnf = json_object_get(jwt, OIDC_CLAIM_CNF);
	if (cnf == NULL) {
		oidc_debug(r, "no \"%s\" claim found in the token", OIDC_CLAIM_CNF);
		goto out_err;
	}

	oidc_jose_get_string(r->pool, cnf, OIDC_CLAIM_CNF_TBH, FALSE, &tbh_str,
			NULL);
	if (tbh_str != NULL)
		return oidc_util_json_validate_cnf_tbh(r, token_binding_policy, tbh_str);

	oidc_jose_get_string(r->pool, cnf, OIDC_CLAIM_CNF_X5T_S256, FALSE, &tbh_str,
			NULL);
	if (tbh_str != NULL)
		return oidc_util_json_validate_cnf_x5t_s256(r, token_binding_policy,
				tbh_str);

	oidc_debug(r,
			" \"%s\" claim found in the token but no \"%s\" or \"%s\" key found inside",
			OIDC_CLAIM_CNF, OIDC_CLAIM_CNF_TBH, OIDC_CLAIM_CNF_X5T_S256);

out_err:

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_OPTIONAL)
		return TRUE;
	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_ENFORCED)
		return FALSE;

	 
	 
	return FALSE;
}