[OAUTH-WG] Re: I-D Action: draft-ietf-oauth-identity-assertion-authz-grant-03.txt

Aaron Parecki <aaron@parecki.com> Wed, 22 April 2026 22:37 UTC

MIME-Version: 1.0
References: <177689619842.1120235.8501085276987816236@dt-datatracker-b45949c58-5szpr>
In-Reply-To: <177689619842.1120235.8501085276987816236@dt-datatracker-b45949c58-5szpr>
From: Aaron Parecki <aaron@parecki.com>
Date: Wed, 22 Apr 2026 15:37:03 -0700
Message-ID: <CAGBSGjrx2fkiw+xMYDTZzDkZh4X8BUM3t8AAW=+2RaNKd2xf+Q@mail.gmail.com>
To: oauth@ietf.org
Content-Type: multipart/alternative; boundary="0000000000006e29350650142c30"
Message-ID-Hash: ZWNQNLRAD7JANS5BMMMHXERB7Y7F2AJA
Precedence: list
Subject: [OAUTH-WG] Re: I-D Action: draft-ietf-oauth-identity-assertion-authz-grant-03.txt
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/h78pXxHry0nKTrQscvAyW4EB1Po>

The editors published a new version of this draft based on feedback
received from implementers over the last couple months.

A summary of the changes:

   - Added a section defining terms used in the document
   - Updated language to be less specific to "enterprise" and more about
   the relationships between the IdP and Resource Authorization Server
   - Clarified the use of the resource and audience parameters in the token
   exchange request
   - Removed language discouraging the use of the actor_token in the token
   exchange request
   - Added a new AS metadata parameter
   authorization_grant_profiles_supported to enable a Resource Authorization
   Server to publish support for this profile

If you graciously offered to review the document after IETF 125, please
make sure to read the latest draft. Thanks!

Aaron


On Wed, Apr 22, 2026 at 3:18 PM <internet-drafts@ietf.org> wrote:

> Internet-Draft draft-ietf-oauth-identity-assertion-authz-grant-03.txt is
> now
> available. It is a work item of the Web Authorization Protocol (OAUTH) WG
> of
> the IETF.
>
>    Title:   Identity Assertion JWT Authorization Grant
>    Authors: Aaron Parecki
>             Karl McGuinness
>             Brian Campbell
>    Name:    draft-ietf-oauth-identity-assertion-authz-grant-03.txt
>    Pages:   58
>    Dates:   2026-04-22
>
> Abstract:
>
>    This specification provides a mechanism for an application to use an
>    identity assertion to obtain an access token for a third-party API by
>    coordinating through an identity provider that the downstream
>    Resource Authorization Server already trusts for single sign-on
>    (SSO), using Token Exchange [RFC8693] and JWT Profile for OAuth 2.0
>    Authorization Grants [RFC7523].
>
> The IETF datatracker status page for this Internet-Draft is:
>
> https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
>
> There is also an HTML version available at:
>
> https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-03.html
>
> A diff from the previous version is available at:
>
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-oauth-identity-assertion-authz-grant-03
>
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> OAuth mailing list -- oauth@ietf.org
> To unsubscribe send an email to oauth-leave@ietf.org
>

[OAUTH-WG] I-D Action: draft-ietf-oauth-identity-… internet-drafts
[OAUTH-WG] Re: I-D Action: draft-ietf-oauth-ident… Aaron Parecki