An STS for the REST of Us

Brian Campbell et al.

IETF 96

Berlin July 2016

current: https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-05

OAuth 2.0 Token Exchange

1

2

Resource Server frontend.example.com

AS/STS as.example.com

Backend Service backend.example.com

Client

Just One Example (a quick illustration in the very unlikely event of some folks not having read the draft)

2

Current Status

l  Draft -05 published July 8 (yes, the cut-off) with relatively minor changes l  Added "cid” JWT claim that can express the client identifier

of the client that requested the token. l  Token introspection response parameter registration for

"act" and "may_act” l  refresh_token now OPTIONAL (was NOT RECOMMENDED) l  Attempt to better clarify the distinction between JWT and

access token URIs. l  Remove some of the ‘Open Issues’

l  No short names l  No supplementary info/claims

3

Moving Forward l  I believe it’s getting close… l  Open Issues

l  Facilitating proof-of-possession cases l  In & out, token binding, use-case diversity

4

l  Other stuff l  ID Tokens

l  URI l  Scope &

“id_token” response parameter

l  The title…