Hi Ben,
See below for some thoughts.
> I'm having trouble understanding the precise URL structures that are used
> here. Can client_uri include a nontrivial path? Why is it necessary to
> repeat client_uri in the response JSON?
The intent here is to follow how "OAuth 2.0 authorization metada
Thanks for this draft! I'm new to the OAuth group but I definitely would
like to see a solution for this problem, and this seems like a good
approach.
I'm having trouble understanding the precise URL structures that are used
here. Can client_uri include a nontrivial path? Why is it necessary to
Hello,
I've spoken to Pieter about this at IETF 115, but this draft (which is
likely to get approved) of subject identifiers could be considered for the
FTA work. This is to enable multiple trust domains to talk about subjects
of tokens in a consistent way. This is already used in the OpenID SSE
I think it would be confusing for implementers to have to figure out the
difference between this implementation and
https://datatracker.ietf.org/doc/html/draft-yusef-oauth-nested-jwt. This
previous one looks to add the exact same information but seems to have a
more robust encapsulation mechanism.
Kelley and I have posted a draft to describe what we are trying to accomplish
within the Fine-Grained Authorization sub-group.
Mike Jenkins
NSA-CCSS
From: internet-dra...@ietf.org
Sent: Tuesday, November 8, 2022 7:13 AM
To: Kelley Burgin ; Michael Jenkins (GOV)
