[Acme] Re: WG Last Call: draft-ietf-acme-authority-token-jwtclaimcon-03 (Ends 2026-07-25)

[Russ Housley <[e-mail]>]

I have read the document, and I support publication, but I think a shortcoming needs to be addressed before it is passed to the IESG.

Section 5.4 says:

> Because this specification involves the JWTClaimConstraints and EnhancedJWTClaimConstraints extensions, the client MAY request an Authority Token with some subset of its own authority as the JWTClaimConstraints provided in the "tkvalue" element of the "atc" JSON object. JWTClaimConstraints can be constructed to define a limited scope of claims and claim values the client has authority over.

This is correct, but I think a few more details are needed.

JWTClaimConstraints specifies claim names that must be included (mustInclude) and it specifies values that are allowed in particular claims (permittedValues). All of the mustInclude need to be in the token.  Each value in the token need to be in the pmittedValues. In this way, the token satisfies the constraints, and a particular certificate can be issued that is a subset of those authorizations.

The structure for EnhancedJWTClaimConstraints is a bit more complex.  It also has claim names that MUST NOT appear (mustExclude). I would expect all of these to be in the token.

Russ

> On Jul 2, 2026, at 6:03 PM, Mike Ounsworth via Datatracker <[e-mail]> wrote:
> 
> This message starts a WG Last Call for:
> draft-ietf-acme-authority-token-jwtclaimcon-03
> 
> This Working Group Last Call ends on 2026-07-25
> 
> Abstract:
>   This document defines an authority token profile for the validation
>   of JWTClaimConstraints and EnhancedJWTClaimConstraints certificate
>   extensions within the Automated Certificate Management Environment
>   (ACME) protocol.  This profile is based on the Authority Token
>   framework and establishes the specific ACME identifier type,
>   challenge mechanism, and token format necessary to authorize a client
>   to request a certificate containing these constraints.
> 
> File can be retrieved from:
> https://www.ietf.org/archive/id/draft-ietf-acme-authority-token-jwtclaimcon-03.txt
> 
> Please review and indicate your support or objection to proceed with the
> publication of this document by replying to this email keeping [e-mail]
> in copy. Objections should be explained and suggestions to resolve them are
> highly appreciated.
> 
> Authors, and WG participants in general, are reminded of the Intellectual
> Property Rights (IPR) disclosure obligations described in BCP 79 [1].
> Appropriate IPR disclosures required for full conformance with the provisions
> of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
> Sanctions available for application to violators of IETF IPR Policy can be
> found at [3].
> 
> Thank you.
> 
> [1] https://datatracker.ietf.org/doc/bcp78/
> [2] https://datatracker.ietf.org/doc/bcp79/
> [3] https://datatracker.ietf.org/doc/rfc6701/
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-acme-authority-token-jwtclaimcon/
> 
> There is also an HTMLized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-acme-authority-token-jwtclaimcon-03
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-acme-authority-token-jwtclaimcon-03
> 
> _______________________________________________
> Acme mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]