IETF Logo Mail Archive

[OAUTH-WG] Re: Call for adoption: draft-schwenkschuster-oauth-spiffe-client-auth-01 (Ends 2025-11-27)

"Lombardo, Jeff" <jeffsec@amazon.com> Thu, 13 November 2025 21:15 UTC

Return-Path: <prvs=40519864d=jeffsec@amazon.com>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 18A1B89038A5; Thu, 13 Nov 2025 13:15:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=amazon.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mC6A9v2kyMzn; Thu, 13 Nov 2025 13:15:57 -0800 (PST)
Received: from pdx-out-013.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-013.esa.us-west-2.outbound.mail-perimeter.amazon.com [34.218.115.239]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id A63D48903852; Thu, 13 Nov 2025 13:15:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1763068556; x=1794604556; h=from:to:cc:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version:subject; bh=ERn5FSTArIbZglOukUzqGk/U5PbnROtv3hogH6KExpA=; b=KrkRrjuYiGb6+1pRVWCL9gVJBfj+2tKMjPBzHSO5viSbu6QZ3WB9Hftn rE4Q4PUdTaFYWMwm1TPrS23SZTqWhmhyIfMpYObsqEPyI/FgS9sdBe3HC UHQl+CSwPMFZz4nuszFOuxtJdanfcgoV73x2qX4MGMeWDZU9EL4rcx8Xb kKxUgD3BdkgSyMfq6XpbDRCetSTybFWpzBKzH0M2/QtHHtal2+RJDok7H 6guoL8E13z+ubKjGw+m2KO051qBOTVFOVhqhY664nj9paOlMDLV6ose48 0Hunf7CUvnpKsks+U/EO8FgFvFpdfl1A0xwebbQQHSIrqAY/nKFXpDAc3 Q==;
X-CSE-ConnectionGUID: wj1nJjdLR3CCF55SKkhmjw==
X-CSE-MsgGUID: 2VHIBFi3RXa6OOFtocBUlw==
X-IronPort-AV: E=Sophos;i="6.19,303,1754956800"; d="scan'208";a="6875596"
Thread-Topic: [OAUTH-WG] Call for adoption: draft-schwenkschuster-oauth-spiffe-client-auth-01 (Ends 2025-11-27)
Received: from ip-10-5-9-48.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.9.48]) by internal-pdx-out-013.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Nov 2025 21:15:52 +0000
Received: from EX19MTAUWB002.ant.amazon.com [205.251.233.111:20122] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.18.51:2525] with esmtp (Farcaster) id 5216c2d3-a71a-404c-8ba8-fccba99aa6dc; Thu, 13 Nov 2025 21:15:52 +0000 (UTC)
X-Farcaster-Flow-ID: 5216c2d3-a71a-404c-8ba8-fccba99aa6dc
Received: from EX19EXOUWC001.ant.amazon.com (10.250.64.135) by EX19MTAUWB002.ant.amazon.com (10.250.64.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.29; Thu, 13 Nov 2025 21:15:52 +0000
Received: from EX19EXOUWB001.ant.amazon.com (10.250.64.229) by EX19EXOUWC001.ant.amazon.com (10.250.64.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.29; Thu, 13 Nov 2025 21:15:51 +0000
Received: from SJ0PR08CU001.outbound.protection.outlook.com (10.250.64.206) by EX19EXOUWB001.ant.amazon.com (10.250.64.229) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.29 via Frontend Transport; Thu, 13 Nov 2025 21:15:51 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Q15AZjqxpSSlxMfCWRw2FEyJzz+B8gaQ8WfXrihknn2k3SopomF/muTWzmVcd9483dyuWWaSXPyIss9Mssy5dIoi2V20k3towSLlZ+xI9p5MWICGZLdx8eksoqwTC1NabobIeO50gI9sI8Se9aTgCMSU1royokMJknf+l3VQDMg/sz0O7dtTUtqAD3KqdaEV9J6D/MOpn5DtKTZ/nw5A3fifPMsmB8pFKMsZj2eJZFh5xb38jFvpVnFmb1GB4GKQdYj/BZQR8bSl4Y0LrIAB8JHcYJYfcaDfDgbkam2Rq++gICuh/tA/g7y1XK+Ld5C3TqpxTgEjLOgvd0uGWOX97A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ERn5FSTArIbZglOukUzqGk/U5PbnROtv3hogH6KExpA=; b=GnfJCDECjL5nX/xAjZN1AvbbFNE8uISa0sb/4fzgprTvmGU+dS/egfomNrV9joMLeTxlxS9cn2Dy99az43kUq8xZ06A/seWbzcGUtoPDGQq6h816Fj/Thpg/bCw1VLV7oLNQb5hG8/Z4+yfcqmCLb5AlmstGkHkXkenrTgVLnrm6TWqk1jAmqjAkuIeRfG6xfLUNvCHcvqdFXvzWjYhsBEKRP0LQAgb/6ScmKhhKKFBLAXK7RJSsTs1bXQDsQiWTt586N6UdVTIMmZkNZfSq5l6kPFieUkOJpyIRjv9IPDWskfw1aPCjxhatWhu4LxAVufF/d58m2pAXkFecK6HKtw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amazon.com; dmarc=pass action=none header.from=amazon.com; dkim=pass header.d=amazon.com; arc=none
Received: from CO1PR18MB4684.namprd18.prod.outlook.com (2603:10b6:303:e7::5) by SJ2PR18MB5786.namprd18.prod.outlook.com (2603:10b6:a03:56e::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9320.17; Thu, 13 Nov 2025 21:15:47 +0000
Received: from CO1PR18MB4684.namprd18.prod.outlook.com ([fe80::6892:d56d:e84a:b165]) by CO1PR18MB4684.namprd18.prod.outlook.com ([fe80::6892:d56d:e84a:b165%7]) with mapi id 15.20.9320.013; Thu, 13 Nov 2025 21:15:47 +0000
From: "Lombardo, Jeff" <jeffsec@amazon.com>
To: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>, "draft-schwenkschuster-oauth-spiffe-client-auth@ietf.org" <draft-schwenkschuster-oauth-spiffe-client-auth@ietf.org>, "oauth-chairs@ietf.org" <oauth-chairs@ietf.org>, "oauth@ietf.org" <oauth@ietf.org>
Thread-Index: AQHcVNjNfPEJowcifkq6CnWzVsDS/LTxG5bg
Date: Thu, 13 Nov 2025 21:15:47 +0000
Message-ID: <CO1PR18MB4684790A0930A233BE836484D9CDA@CO1PR18MB4684.namprd18.prod.outlook.com>
References: <176306425545.723.7575571157729601398@dt-datatracker-5bd94c585b-wk4l4>
In-Reply-To: <176306425545.723.7575571157729601398@dt-datatracker-5bd94c585b-wk4l4>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=amazon.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CO1PR18MB4684:EE_|SJ2PR18MB5786:EE_
x-ms-office365-filtering-correlation-id: 6e7aa5b5-0402-4dcc-a605-08de22f9d09f
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|4022899009|366016|376014|1800799024|38070700021;
x-microsoft-antispam-message-info: Pguw+fybTezVJD66btvPaRodvbhXp2Sd1d52Aa4+JILihWRhNVDBS3uXW3fsqVWirKOEPITIY9bLbN9dRtZhn68SXt6+W/SrScB5rRlMo+sbNcA51pxk38OlTsYe8D6I9aaT3dnVOkvKkv6a+aa5m7ii2k/Xb7TPHM1/AnhgQgds9VXVBTsmski8vYe/+aupq/1EBtO1/k5cMXb3X31BtYPp2sK4ZPP2A+SOlV6jemt92l6z/N68c6ZRZtK1vgRToURxrvHi5HZtKWSPSLt+qxpHxcE4JRZBEQz3xNYD9ccJU53yq4FelDXYQQa2tdB1L57lIw1TV+S00pqMMrdYDRnB96RSF2qo62lkEBNF79nsN0AeZw9SKwzwldUzGm4lomkP5iec+BYcJSpCkG0gllNYjcePrSMYaEozQ0iB00/lj6+t0/tEZQq3Ou2xgbl3CN3b664bKxt54HUamZD8cJ+ftaEezHFt23p4NU3nwjKXkuuFXGJ6JizfK02+7MD15U2en0mgsJW8y2phMOoKce9giQQAeRhCxxi2Oh6zsRvHZO3yIK2zDuXcAyILRYJST/i1F8d3Lt8GBETnpwknhSSt3CAfcehY5gJj/07lskxw7x3MDSN5tL5PRUBkLC6DXwvOSewAletbBr8w+yrmX+R5KXSS7q++I0gePVfFjUmllslNkTKuYuJMjwB/8l7VlIOM65jevK2y4+QrJQXkfvwbx94Tbra3eLnsbxHRqhA6z3mS9UOBXI+9FiOc9WhP/GGDneHYNBvx4uxIeQ8EoNamK6PDrB0NsmwCSFqp1JtKWKd6AQ5nEsOf9MwXRnOfIxdyIkCPLU++HfgnGOAdpxywbuZ2X5ub8Ec2+MBMuSoGLdKa/0TXpxozpV1XrNFe+ojqTlEHWUZ6B64qjzOzgpSdKPCX+5YtJPBBMW/ogAiUqKoH/uA2wTvx35eTm6QEf6tnzRSEDO+onC+lHv7eJwH8Yzu67WuRGF0qLD5dyg7HswmU2EcbOA0VtEZCAakSPTltv6xGBFDj433b5h3yCIVa3cfe0GBMNPqu4UWgj3AQzDuV36bNarUIIloIz9I/6ao2BMsK73e/uHCfuxHhlmPKhYJrCHlU6wCPoyZAnYc0i2cUGnpHWB89Q+arBlwka0dC0veBI4H0cX6MBnqGxmRK0eABuJ1KCnJUEQDWclhNBHY/mi/mtt+XI0zS2hvm2OJ8TZ0qlmwwBB1tmAOEoWdYx2+2DRddXND1J/uUzaG0UKPRjRTd9+giq27JjV5QvsJklUbMQ6O5awgkJ2Rn0cwijIGnDIUT0G+ZjgzGWi9gnvyK3mY7qRWo7HYIVPxQyRtrtKyhXbLj5Oie6LHsv/qlTajMvpYAgjUfCQ6dqWue0DhcFKWPO/FF52SDfuKNw5lDHDvWMKPPuwgcrjBMzW5nYXMNeHXYIPrafZ4jcVctjk3S6wICvR9CcQ5mHpY7dtYZHH5IV4qKF95AFQVnhA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CO1PR18MB4684.namprd18.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(4022899009)(366016)(376014)(1800799024)(38070700021);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: SYkZeQznmfGGohk/FyaoFdunE108UMYo/MkkgYOCfjXq5yM88ixFYIJ/k9OBR4QGtEw33AHdh7iduRexp31hFvIgCGOUnve33S1el03vkND0UZr0poooFoSPoCf2Pw/5hVVUvkxtBHNZFYIHgyq2nTKlTj89CqClbWFlFI+6981uYTsb573A+LfjhyM0+BiDorBeuOPviyqu9/BumudX0mkUdkHkp4c72rBVyzBjx75rnFqV+USR0H08TR9ydx3M5R4I/L9Wh7CxBJrhLXw13DkpeyACcX+v2qmYElZi5hRko8ceRBkUyCEAx2ARr6ovquMbzdwJrNz7JKtC0wfvn44IoBvXNAjLrzOoX4AjAqkRCzZiZb1TAxDreDOveqBCP2tstcR+gg+Cmw1Pq486Gf4M4KXW0Gv2Q5p+f8GemfKbbOuCqauwF3+2dPhLPc+G/Detl03l6kNtOdKAO2wt2pZ82FW2FwAxIWOTwo1C/97pL5Klq3ANEDi397FPA2frqHhndkda48YQZlGXzSM4ocZpbY18sxcf3IzNEm7spn1qIwuG+Ul4AMGbDSW5tqsy3qy8fp98OJjy/U2uYJYTYxTgIhgb+WHCPYfFRYx7Ce7H3Y65HHewDMuNJQO0F/v5b8I5kRp5mR70oMpzabYo54e9TF8ViyTY9sxafynpdKDkRIb2ep9MSZ6gonRV+amN5BVzAMi0SiGiWj+nkkb55NqJZXJB32mQcqt8XAcwNlkk0n8KwCfRZAY7Ef000yINA/6ctS/5/0zICckpTOeW8s1xc5DQji1uygzNen0UHRPeMZMVzAnVoFswlxR2Z5ym1/EV8FQoZ34c57H8+Mj6gKO78SsjQjlTsR+KlJoMeiLjIX40ldfG6yUiffyHmQjq7a696T0ONfQ3r6pRWoxuXWMzS+HKaxwAuWUjv4AqlAgLGcacEp0xJoKJi9XgoawONr3hHwjDNs6CC9BoxW7sRBgCWQDHzUe/qBDQ6Xnm1eYgIsupvE5XLv3r/McIEi64XV8AVm/OUmllo0s1AITKOB8k00jkiJ3Hu5G7tmq5N9yQGISnYCV35FQTCb4OQeSzR6V9UHolKiGclaNPfAakjWlyhRPfEGQj6wjqEp0TSgWjCTAoC2vAeHHnyNl7gJw8ugadbHUJECFADrs9naDU7De2ILNt3BfLKVb4rGHzTHxx7PxS1icH+m7vK/oUz8BAmXh9YUw/tWsKmM9d630i1iRJLaAPTucs4oA3AdR4awoLPNGhzLKulwqNtEakYM3KVROvnlFD6xeNCGkuu9i/mHh3kZK1E61Kwz6edNsVOdbJUfvd8VoACSIyoP4X2s0bEY7u2doW942eh13vnJfA3jNMY+r4HoZrcfiH+yqKD8ZWdbzhmriNSLP9hS+oP5sfkerEjyEP5fOmD809bpXeyjZn2p1DfKyv/9r/nyDAWvmfJQc0e4KaNSzxJ4q59grPluLwzRgjF9JafyqpyJhz82WMt5ZHcV/NI0lDU1a6/hYXQ5uf42oQ1DZHx3DRUcM864MhIc2XMwECx93oefkf6WnRtCYpyRXptmgtleRIHOhLtbxxhmGVXQGaBshi6fK/
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CO1PR18MB4684.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6e7aa5b5-0402-4dcc-a605-08de22f9d09f
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Nov 2025 21:15:47.5340 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5280104a-472d-4538-9ccf-1e1d0efe8b1b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: UIlgLuKb7OR6Cz2Q5eKx26+l9DimzecISnHQDfs4tN4unN22teqXvxBvuJSVFwduPBh34VjiA1SRQzTK7kYQGw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR18MB5786
X-OriginatorOrg: amazon.com
Message-ID-Hash: HYPMMA2BYIMX4CA5HDXZAIPTLRTPLZHQ
X-Message-ID-Hash: HYPMMA2BYIMX4CA5HDXZAIPTLRTPLZHQ
X-MailFrom: prvs=40519864d=jeffsec@amazon.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Re: Call for adoption: draft-schwenkschuster-oauth-spiffe-client-auth-01 (Ends 2025-11-27)
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Z-KwlJJNAjkl8C617_bEv8Rlw70>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

I support adoption

Jean-François “Jeff” Lombardo | Amazon Web Services

Architecte Principal de Solutions, Spécialiste de Sécurité
Principal Solution Architect, Security Specialist
Montréal, Canada

Commentaires à propos de notre échange? Exprimez-vous ici.

Thoughts on our interaction? Provide feedback here.

-----Original Message-----
From: Rifaat Shekh-Yusef via Datatracker <noreply@ietf.org> 
Sent: November 13, 2025 3:04 PM
To: draft-schwenkschuster-oauth-spiffe-client-auth@ietf.org; oauth-chairs@ietf.org; oauth@ietf.org
Subject: [EXT] [OAUTH-WG] Call for adoption: draft-schwenkschuster-oauth-spiffe-client-auth-01 (Ends 2025-11-27)

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



AVERTISSEMENT: Ce courrier électronique provient d’un expéditeur externe. Ne cliquez sur aucun lien et n’ouvrez aucune pièce jointe si vous ne pouvez pas confirmer l’identité de l’expéditeur et si vous n’êtes pas certain que le contenu ne présente aucun risque.



Subject: Call for adoption: draft-schwenkschuster-oauth-spiffe-client-auth-01
 (Ends 2025-11-27)

This message starts a 2-week Call for Adoption for this document.

Abstract:
   This specification profiles the Assertion Framework for OAuth 2.0
   Client Authentication and Authorization Grants [RFC7521] and JWT
   Profile for OAuth 2.0 Client Authentication and Authorization Grants
   [RFC7523] to enable the use of SPIFFE Verifiable Identity Documents
   (SVIDs) as client credentials in OAuth 2.0.  It defines how OAuth
   clients with SPIFFE credentials can authenticate to OAuth
   authorization servers using their JWT-SVIDs or X.509-SVIDs without
   the need for client secrets.  This approach enhances security by
   enabling seamless integration between SPIFFE-enabled workloads and
   OAuth authorization servers while eliminating the need to distribute
   and manage shared secrets such as static client secrets.

File can be retrieved from:
https://datatracker.ietf.org/doc/draft-schwenkschuster-oauth-spiffe-client-auth/

Please reply to this message keeping oauth@ietf.org in copy by indicating whether you support or not the adoption of this draft as a WG document.
Comments to motivate your preference are highly appreciated.

Authors, and WG participants in general, are reminded of the Intellectual Property Rights (IPR) disclosure obligations described in BCP 79 [2].
Appropriate IPR disclosures required for full conformance with the provisions of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
Sanctions available for application to violators of IETF IPR Policy can be found at [3].

Thank you.
[1] https://datatracker.ietf.org/doc/bcp78/
[2] https://datatracker.ietf.org/doc/bcp79/
[3] https://datatracker.ietf.org/doc/rfc6701/



_______________________________________________
OAuth mailing list -- oauth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status