[OAUTH-WG] Éric Vyncke's No Objection on draft-ietf-oauth-dpop-14: (with COMMENT)

2023-04-10 Thread Éric Vyncke via Datatracker
Éric Vyncke has entered the following ballot position for draft-ietf-oauth-dpop-14: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to

Re: [OAUTH-WG] [IANA #1270370] Request to register OAuth Authorization Server Metadata: dpop_signing_alg_values_supported

2023-04-10 Thread Nat Sakimura
I approve, too. 2023年4月6日(木) 3:34 Mike Jones : > I also approve this request. > > > > -- Mike > > > > *From:* John Bradley > *Sent:* Wednesday, April 5, 2023 11:13 AM > *To:* dick.ha...@gmail.com > *Cc:*

[OAUTH-WG] [IANA #1270468] expert review for draft-ietf-oauth-dpop (oauth-parameters)

2023-04-10 Thread David Dong via RT
Dear Justin, Hello. Have you had a chance to review these proposed registrations? The due date is Wednesday April 12th, 2023, as this document is on this week's IESG telechat agenda. Thank you very much for your time. Best regards, David Dong IANA Services Specialist On Thu Apr 06 15:22:17

[OAUTH-WG] [IANA #1270470] expert review for draft-ietf-oauth-dpop (jwt)

2023-04-10 Thread David Dong via RT
Dear John and Hannes, Hello. Have you had a chance to review these proposed registrations? The due date is Wednesday April 12th, 2023, as this document is on this week's IESG telechat agenda. Thank you very much for your time. Best regards, David Dong IANA Services Specialist On Thu Apr 06

[OAUTH-WG] [IANA #1270467] expert review for draft-ietf-oauth-dpop (oauth-parameters)

2023-04-10 Thread David Dong via RT
Dear Hannes, Hello. Have you had a chance to review these proposed registrations? The due date is Wednesday April 12th, 2023, as this document is on this week's IESG telechat agenda. Thank you very much for your time. Best regards, David Dong IANA Services Specialist On Thu Apr 06 15:14:01

Re: [OAUTH-WG] Ambiguity in draft-ietf-oauth-v2-1-08 when code_challenge is omitted

2023-04-10 Thread M Hickford
On Wed, 5 Apr 2023 at 08:00, M Hickford wrote: > > https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-08.html#name-countermeasures-2 > says > > > To prevent injection of authorization codes into the client, using code_challenge and code_verifier is REQUIRED for clients, and authorization

[OAUTH-WG] Authorization server antipattern: not recording client type

2023-04-10 Thread M Hickford
OAuth defines two client types, confidential and public. https://datatracker.ietf.org/doc/html/rfc6749#section-2.1 > The client type designation is based on the authorization server's definition > of secure authentication and its acceptable exposure levels of client > credentials. The