Subject: [saag] OAuth WG Summary

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 31 Jul 2013 13:46:30 +0200

The OAuth working group met on Wednesday 31 July 2013 at 9:00 CEST.

The meeting time was largely spent on discussing a working group item, called "Dynamic Client Registration", which allows an OAuth client to update and retrieve initial configuration parameters and keying material from an OAuth authorization servers. While a lot of time has been spent discussing the current working group document (see draft-ietf-oauth-dyn-reg) already since the last IETF meeting but various questions surfaces, including an alternative solution proposal, and the need to interact with other groups/SDOs (who are potential consumers of the developed technology). 

Besides the challenges in the dynamic client registration work the group is making progress on other chartered items. The OAuth Token Revocation document was recently completed and is currently in the RFC Editor Queue, the WGLC for three assertion documents has been started, and the WGLC of the JSON Web Token (JWT) is planned to be started soon (since the JOSE working group, on which this work depends, is progressing nicely). 

To accelerate the work design teams will be created for these two areas of work:  
  * the "Mac Token" (draft-ietf-oauth-v2-http-mac) + the HOTK document (draft-tschofenig-oauth-hotk), and 
  * the dynamic client registration. 

At the end of the meeting we also discussed future work and various items were proposed, including a new security extension (draft-sakimura-oauth-tcse), OAuth Token Introspection (draft-richer-oauth-introspection), JSON Metadata for OAuth Responses (draft-sakimura-oauth-meta), and User Authentication for Client (draft-hunt-oauth-v2-user-a4c).