End user credentials support analogous to IAssertion is required for both token endpoint and client.
Bug watches keep track of this bug in other bug trackers.