Subject: [saag] OAuth Meeting Notes

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 28 Mar 2019 12:48:12 +0000

We held the 5th OAuth Security workshop last week in Stuttgart. We had tutorials, presentations, unconference sessions, and keynote speeches.
The workshop was well attended and well received. All material can be found at https://sec.uni-stuttgart.de/events/osw2019

During the two OAuth WG sessions we talked about the following items:

* OAuth Security BCP
https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/

Torsten gave an update on the OAuth security BCP. The recommendation against the use of the implicit grant is probably the most significant recent addition to the draft.

* JWT Introspection Response:
https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-introspection-response/

The group agreed that the spec is ready for WGLC.

* User Managed Access (UMA)
https://datatracker.ietf.org/doc/draft-maler-oauth-umagrant/
https://datatracker.ietf.org/doc/draft-maler-oauth-umafedauthz/

Eve and Maciej presented specifications put together in the Kantara Alliance. The UMA specifications describe a number of use cases and we discussed them during the meeting. Eve clarified the intention with the document submissions: she wants to have the OAuth WG to work on them.

* JWT Usage in OAuth2 Access Tokens
https://datatracker.ietf.org/doc/draft-bertocci-oauth-access-token-jwt/

This document was produced during the OAuth Security Workshop and describes best current practices of what claims are contained in an access token.

* Browser-based App BCP
https://datatracker.ietf.org/doc/draft-ietf-oauth-browser-based-apps/

This document defines best current practices for apps running in a browser. Aaron presented open issues and the group came up with suggestions on how to resolved them.

* PoP Key Distribution
https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-key-distribution/

The group discussed whether the document is missing a recommendation for demonstrating the possession of the private key for the public key that is placed in a JWT/CWT.

* MTLS Update
https://datatracker.ietf.org/doc/draft-ietf-oauth-mtls/

Torsten presented the current status of the document and further open issues were presented.

* Nested JWT
https://datatracker.ietf.org/doc/draft-yusef-oauth-nested-jwt/

Rifaat presented the idea of a nested JWT.

* OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer
https://tools.ietf.org/html/draft-fett-oauth-dpop-00

This document was added to the agenda short notice and was a result of discussions
at the OAuth Security Workshop. The focus of the document is to provide an security solution
for use of OAuth in browsers.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.