Subject: [saag] OAuth IETF 103 Summary

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 8 Nov 2018 05:11:28 +0000

We had two productive sessions in OAuth. The key highlights are:

- The group ran into problems with the work on token binding since browser support is not looking good. Additionally, we couldn't find out how to secure the implicit flow using token binding. It appears like OAuth Mutual TLS (MTLS) is the way to go forward.

 - The OAuth security recommendations described in draft-ietf-oauth-securtity-topics now states that the implicit flow is not a viable choice due to the security challenges it poses. The recommendation is to use the authorization code grant.

 - Several working group documents got discussed and advanced without any problems. These include PoP key distribution, resource indicators, OAuth MTLS, Distributed OAuth, Reciprocal OAuth
 - We saw proposals for new work: Torsten presented a proposal for 'JWT Secured Authorization Response Mode' and promised to submit a draft  to the group. Aaron proposed a new draft describing recommendations for 'OAuth 2.0 for Browser-Based Apps' (draft-parecki-oauth-browser-based-apps-00). Omer presented the 'Seamless OAuth 2.0 Client Assertion Grant' draft (draft-hevroni-oauth-seamless-flow-00) and he is looking for review comments.

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.