According to OpenID Connect API Reference, a PUT request (=update client) to OIDC dynamic client registration endpoint should include registration_access_token provided in header Authorization: Bearer <token>, just like GET request (=get client data). But when attempted, this results in an "invalid token" error.

Oxauth.log shows on TRACE level that RegisterRestWebServiceImpl asks GrantService to verify the provided registration_access_token. But the latter token is not stored in ou=token, o=gluu (i.e. not among regular access_tokens and authorization_codes). It is instead stored in inum=<clientI_id>, ou=clients, o=gluu. So the verification attempt fails in grant lookup returning null.

Due to this problem I have not yet found a way to dynamically update redirect_uris for an existing OIDC client.