Subject: [saag] IETF#100 OAuth WG Meeting Report

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 16 Nov 2017 06:20:55 +0100

The OAuth working group met twice this week. The key points of the
meetings were:

* We have a document (see draft-ietf-oauth-security-topics-03) that
offers recommendations on OAuth security topics and we are seeking input
on these recommendations.

* We are finalizing the OAuth Device Flow work, which is used by devices
that have limited UI capabilities. Another WGLC will follow soon.

* We are looking for crypto experience on the JWT BCP, see
draft-ietf-oauth-jwt-bcp-00.

* For the OAuth 2.0 Token Binding we are looking for implementation
experience.

* Several new items were proposed:

  - a way for a user to pair protected resources that would like to
request access to each other in draft-hardt-oauth-mutual-00

  - a way for the OAuth client to discovery what authorization server to
use with a given resource server in draft-hardt-distributed-oauth

  - A solution for conveying attestation information to an authorization
server in draft-wdenniss-oauth-device-posture

  - The use of PSK and RPK-based proof-of-possession tokens in
draft-erdtman-ace-rpcc

  - The use of the DNS for identity management in
draft-bertola-dns-openid-pidi-architecture-00

The group expressed interest to work on the first two items. Further
discussion and experimentation on the other ideas is needed.