Protocol Action: 'OAuth 2.0 Authorization Server Metadata' to Proposed Standard (draft-ietf-oauth-discovery-10.txt)

The IESG <iesg-secretary@ietf.org> Wed, 21 March 2018 14:36 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Subject: Protocol Action: 'OAuth 2.0 Authorization Server Metadata' to Proposed Standard (draft-ietf-oauth-discovery-10.txt)
Auto-Submitted: auto-generated
Precedence: bulk
Cc: The IESG <iesg@ietf.org>, ekr@rtfm.com, oauth@ietf.org, draft-ietf-oauth-discovery@ietf.org, Hannes Tschofenig <Hannes.Tschofenig@gmx.net>, Hannes.Tschofenig@gmx.net, oauth-chairs@ietf.org, rfc-editor@rfc-editor.org
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-ID: <152164300026.7507.13873266401942906419.idtracker@ietfa.amsl.com>
Date: Wed, 21 Mar 2018 07:36:40 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf-announce/OqXn4j5UCrA4RaUpeLm0dIHJeds>

The IESG has approved the following document:
- 'OAuth 2.0 Authorization Server Metadata'
  (draft-ietf-oauth-discovery-10.txt) as Proposed Standard

This document is the product of the Web Authorization Protocol Working Group.

The IESG contact persons are Kathleen Moriarty and Eric Rescorla.

A URL of this Internet Draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-discovery/





Technical Summary

This specification defines a metadata format that an OAuth 2.0 client
can use to obtain the information needed to interact with an OAuth
2.0 authorization server, including its endpoint locations and
authorization server capabilities.

Working Group Summary

Work on a discovery mechanism for OAuth was planned since a long 
time but it took till late 2015 before a document was submitted 
to the group, which re-used work done in the OpenID Foundation.
When the WGLC was started in 2016, see 
https://www.ietf.org/mail-archive/web/oauth/current/msg15796.html, 
feedback resulted in refocusing the scope of the specification, 
removing everything except for the authorization server metadata. 

Now, almost a year later these concerns have been resolved and
the document is ready for publication. 

Document Quality

The document scope has been changed to capture current deployment 
practice. 

There are 34 authorization server and 9 OAuth client implementations
listed at http://openid.net/certification/ that implement metadata 
compatible with the AS metadata specification.
(See the "Config OP" and "Config RP" columns.)

Microsoft and Google are using this specification in deployment. 

Personnel

Hannes Tschofenig is the document shepherd and the responsible area 
director is Eric Rescorla.

Protocol Action: 'OAuth 2.0 Authorization Server … The IESG