[OAUTH-WG] Re: OAuth IETF 127 Call for Agenda Items

[Yaron ZEHAVI <[e-mail]>]

Thanks Emelia,
+1 on that request and I'd like to also ask for a short slot to present a related draft:
https://www.ietf.org/archive/id/draft-zehavi-oauth-authority-metadata-00.html

It tackles sender-constraining required signaling, but from the perspective of the protected resource metadata.
It adds resource server requirements from the access token (sender-constraining, max_age, max_lifetime, acr_values), guiding a client to request a compliant token from the authorization server.

Regards,
Yaron



Classification: GENERAL
From: Emelia S. <emelia=[e-mail]>
Sent: Monday, November 2, 2026 11:16 PM
To: Rifaat Shekh-Yusef <[e-mail]>
Cc: oauth <[e-mail]>
Subject: [OAUTH-WG] Re: OAuth IETF 127 Call for Agenda Items

This message is from an external sender - be cautious, particularly with links and attachments.

Hi Rifaat and Hannes,

I'd like to request the absolute shortest amount of time on the agenda to raise attention of the working group to my newly published internet draft for OAuth Authorization Server Metadata Parameter for Requiring DPoP (https://datatracker.ietf.org/doc/draft-emelia-oauth-as-metadata-dpop-required/)

This draft fills a gap that was affecting the ability for MCP Servers to always require DPoP bound access tokens, as previously they could only signal this for resource servers, not for the authorization server itself. This could be done as a 1-2 minute slide following on from the CIMD slot, since that's where this draft came from.

It also enables AT Protocol Authorization Servers to correctly signal to clients that they must use DPoP Bound access tokens, and in particular that the authorization server won't issue non-dpop-bound access tokens.

Thanks,
Emelia Smith


On 6 Oct 2026, at 19:53, Rifaat Shekh-Yusef <[e-mail]<mailto:[e-mail]>> wrote:

All,

The OAuth working group chairs have requested 2 two-hour meeting slots on the agenda for IETF 127 in San Francisco.

In addition, as the intersection between the work of the WIMSE and OAuth working groups becomes increasingly important,
the chairs of both groups have requested an additional two-hour joint session dedicated to topics that touch both groups.
For example, transaction tokens are defined as OAuth artifacts but relate directly to workload security.

At this time the OAuth chairs are soliciting proposals for both the dedicated OAuth sessions and the joint WIMSE/OAuth session.
Please send your requests to the mailing list or directly to the chairs, indicating whether your request is for the OAuth session,
the joint session, or could fit in either session.

Current working group items and proposals with demonstrated interest from multiple different parties will get priority.

Please note that the Internet-Draft submission cut-off is Monday, 2 November 2026 at 23:59 UTC [1].
Please ensure that new drafts and updates to existing drafts are published in Datatracker before the deadline.

Regards,
 Rifaat and Hannes

[1] https://datatracker.ietf.org/meeting/important-dates/

_______________________________________________
OAuth mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>

This message and any attachment ("the Message") are confidential. If you have received the Message in error, please notify the sender immediately and delete the Message from your system, any use of the Message is forbidden. Correspondence via e-mail is primarily for information purposes. RBI neither makes nor accepts legally binding statements via e-mail unless explicitly agreed otherwise. Information pursuant to ? 14 Austrian Companies Code: Raiffeisen Bank International AG; Registered Office: Am Stadtpark 9, 1030 Vienna, Austria; Company Register Number: FN 122119m at the Commercial Court of Vienna (Handelsgericht Wien).