[OAUTH-WG] Weekly github digest (OAuth Activity Summary)

Repository Activity Summary Bot <do_not_reply@mnot.net> Sun, 17 May 2026 09:24 UTC

Return-Path: <do_not_reply@mnot.net>
X-Original-To: oauth@mail2.ietf.org
Delivered-To: oauth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 0A902EF7F4FC for <oauth@mail2.ietf.org>; Sun, 17 May 2026 02:24:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1779009855; bh=f9LQYo/T+k4pBddr1gVnG3xk8NhGMqRWiCljo2ItdH8=; h=From:To:Subject:Date; b=k/D6STfs/BI7RuvVjYv0f52E4B9YgsvEgKOY0mhJqfMt16+nz2XcH8M3Eb+8cWdhf fgUOKbl5qL0pQ6WfqT5RBebW9oWeXk42sRgtEBBBM9Fg+xRzpB7JeW2kYXjpBHpauZ DUOSuWRCI4K2fRgLOd7iGKrzlUJ6fA82CGOrNLs0=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.397
X-Spam-Level:
X-Spam-Status: No, score=-2.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=mnot.net header.b="RMzBzpsz"; dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=messagingengine.com header.b="MBPUgMYO"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EhFbuW02Q9Zk for <oauth@mail2.ietf.org>; Sun, 17 May 2026 02:24:14 -0700 (PDT)
Received: from fhigh-b5-smtp.messagingengine.com (fhigh-b5-smtp.messagingengine.com [202.12.124.156]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 8878FEF7EF3F for <oauth@ietf.org>; Sun, 17 May 2026 02:22:16 -0700 (PDT)
Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailfhigh.stl.internal (Postfix) with ESMTP id 3DF9F7A003F for <oauth@ietf.org>; Sun, 17 May 2026 05:22:16 -0400 (EDT)
Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-03.internal (MEProxy); Sun, 17 May 2026 05:22:16 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h=cc :content-type:content-type:date:from:from:in-reply-to:message-id :mime-version:reply-to:subject:subject:to:to; s=fm1; t= 1779009736; x=1779096136; bh=3+vDFXIHZ2mRiPyfXz1BJoO6Y7agr896w9l Pd2nA6ZE=; b=RMzBzpszA317BRDaR+StAo7FksusGrlv2+xN9XERCkhGdphfdb6 sb7nlh9ogk2lp2Co8Ta4n1D6NPbUWDunwCZYSfQ3Y86aaAgL+1SkOjSu3fF97a/M h6VX0d5WINvIE6UBumA38MBcuO3Nf/ryz7LM1IGDpQP++JcXKbTUSIzKOcoZgjkP E25e6BWS0sTe/4YRJXZaKSLGZ9nOJW9oK7Njkg01pYboUN73rzncZO/8ux5qJepU heHLAh0QwQVWcx1KyNZEQKknaq2hqJa2kr8XFwAHvll5Ss+/db9wUOOotloVLjrX +dJcAzXwIKkPcTKGF9DwjyWpHroJLJt2f8w==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:content-type:date :feedback-id:feedback-id:from:from:in-reply-to:message-id :mime-version:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779009736; x= 1779096136; bh=3+vDFXIHZ2mRiPyfXz1BJoO6Y7agr896w9lPd2nA6ZE=; b=M BPUgMYOifCZB9EpCfgm66T3T/sq//jLCIYO4uvttg6PIOeAK223v2A3iz6+SmAEX B2gWuv6v1oyySVcsa8O8qB4gJQ4lzksXl/ZKJKWA7hBcNSTlCJ/j2T1sW/N2AKEc aSv5Yvv9vjq8vPuLaq7B0SPnOyv3Ets3B6Kdh/1i5TaXdp59xzH7LhKVxD0cyvdu C/YM6z87KBhcDdFmC8KjF8UH+tLt8twVZiNoO9ott5x2F3HyQGu/cWUE7SnTRjJp pPcPca4i6JSFIRc7wlNlHhjLAe5D5kQ5CN+R5l8k4v2fRrS252wSllUU+URmSGVu L+eEH8YzWU49kzgI0Oecg==
X-ME-Sender: <xms:yIgJarZmzSTpM3iNuTHANHH8RV6qPkYw0r7G8epZ2fHZuZrJr5UeDw> <xme:yIgJagTRISx-ySbDUJ4_mgYk7Pa7rk-DfI7SxZEte1eugBRVHe5IGXUguO801TYNc DbQDpoFLHlmPWuDZYwAv5ao5mrICLHg2KukGIwLRxCU-Naz_7cfFw>
X-ME-Received: <xmr:yIgJapBjkFzQie4LDziOPWoqIXdY6QQRxNaLxXaeDFukPzZr1N8-9ZZ8d2ZhL0UkQd2r5JMJvuhLeohelXhKjSGStbYo_cq28H-0ZdSMXk50T-UR2451e-eMDLcisMEJ6uh8e1s>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefhedrtddtgddufeehieduucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucfpohcuuggrthgvuchfihgvlhguucdlgeelmdenucfjug hrpegtggfhvffusegrtddtredttdejnecuhfhrohhmpeftvghpohhsihhtohhrhicutegt thhivhhithihucfuuhhmmhgrrhihuceuohhtuceoughopghnohhtpghrvghplhihsehmnh hothdrnhgvtheqnecuggftrfgrthhtvghrnhepkeefvdduteejvdefkeehieevuefgfefh teetveegffekffefteffvdelheduieetnecuffhomhgrihhnpehgihhthhhusgdrtghomh enucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpeguohgp nhhothgprhgvphhlhiesmhhnohhtrdhnvghtpdhnsggprhgtphhtthhopedupdhmohguvg epshhmthhpohhuthdprhgtphhtthhopehorghuthhhsehivghtfhdrohhrgh
X-ME-Proxy: <xmx:yIgJaufYTXL3CZWQnkKM67t1Furenln3VJXEtVZxCHdDxqTgtLOOeg> <xmx:yIgJaqNPG1_ayeZTZsDPnyidBzpQaUSMIGiNxIstUvjVRZg5TlD9_g> <xmx:yIgJao7b5jTwyHuUnsixake2PO9z2MtyMOp7w1WZhOsGmZ33pA3r3Q> <xmx:yIgJauIEmhsuD9n8pdpizeY1iVJpDIv5lOiTg2w7NXEM4IfO85ds8w> <xmx:yIgJalDDHJmMBpAQTECiMYkrw505hWrKgkOnDWpb9svOkfndcJvCK8ip>
Feedback-ID: i1c3946f2:Fastmail
Message-Id: <1779009736.2407869.4085451D@outbound.messagingengine.com>
Received: by mail.messagingengine.com (Postfix) with ESMTPA for <oauth@ietf.org>; Sun, 17 May 2026 05:22:15 -0400 (EDT)
Content-Type: multipart/alternative; boundary="===============1950328435098842565=="
MIME-Version: 1.0
From: Repository Activity Summary Bot <do_not_reply@mnot.net>
To: oauth@ietf.org
Date: Sun, 17 May 2026 02:22:16 -0700
Message-ID-Hash: 6S6T2HUO4TC4OEMNZHI7EIX4OCC2E3YS
X-Message-ID-Hash: 6S6T2HUO4TC4OEMNZHI7EIX4OCC2E3YS
X-MailFrom: do_not_reply@mnot.net
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-oauth.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [OAUTH-WG] Weekly github digest (OAuth Activity Summary)
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/x6nkcBmCxPo-LeivBaA17wp0Apo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>



Events without label "editorial"

Issues
------
* oauth-wg/oauth-identity-chaining (+0/-1/💬1)
  1 issues received 1 new comments:
  - #189 GENART Review by Lars Eggert (1 by bc-pi)
    https://github.com/oauth-wg/oauth-identity-chaining/issues/189 

  1 issues closed:
  - GENART Review by Lars Eggert https://github.com/oauth-wg/oauth-identity-chaining/issues/189 

* oauth-wg/oauth-transaction-tokens (+3/-0/💬3)
  3 issues created:
  - Using RFC 9396's authorization_details as a claim and for request_context (by sdatspun2)
    https://github.com/oauth-wg/oauth-transaction-tokens/issues/351 
  - ​​subject_token​ and deferred transactions (by dteleguin)
    https://github.com/oauth-wg/oauth-transaction-tokens/issues/350 
  - More rctx/tctx fun (by dteleguin)
    https://github.com/oauth-wg/oauth-transaction-tokens/issues/349 

  2 issues received 3 new comments:
  - #349 More rctx/tctx fun (2 by dteleguin, gffletch)
    https://github.com/oauth-wg/oauth-transaction-tokens/issues/349 
  - #324 Minor bugs in the example (1 by dteleguin)
    https://github.com/oauth-wg/oauth-transaction-tokens/issues/324 [WGLC Feedback] 

* oauth-wg/oauth-v2-1 (+1/-0/💬0)
  1 issues created:
  - Request for a multi-account Authorization Code flow that generates unique access tokens per account (by dfcoffin)
    https://github.com/oauth-wg/oauth-v2-1/issues/251 

* oauth-wg/draft-ietf-oauth-attestation-based-client-auth (+1/-1/💬6)
  1 issues created:
  - Interims Feedback: RS metadata to signal demand for client attestation (by paulbastian)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/195 

  5 issues received 6 new comments:
  - #170 Client metadata ? (1 by paulbastian)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/170 [discuss] [ready-for-pr] 
  - #168 Integrity protecting HTTP requests using DPoP and Client Attestations (1 by Denisthemalice)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/168 [pending-close] [out-of-scope] 
  - #163 A client should be able to request a challenge without using a challenge endpoint (1 by paulbastian)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/163 
  - #159 The Client Attestation PoP JWT should be able to support a data origin authentication service (1 by Denisthemalice)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/159 [pending-close] 
  - #155 The privacy considerations in section 11 from RFC 9334 should be endorsed (2 by Denisthemalice, paulbastian)
    https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/155 [pending-close] 

  1 issues closed:
  - List alg as REQUIRED parameter for both Client Attestation JWT and PoP JWT https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth/issues/190 [has-pr] 

* oauth-wg/oauth-identity-assertion-authz-grant (+1/-0/💬9)
  1 issues created:
  - How can a Resource Authorization Server recognize an ID-JAG when it is configured with SAML SSO (by aaronpk)
    https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/94 

  2 issues received 9 new comments:
  - #94 How can a Resource Authorization Server recognize an ID-JAG when it is configured with SAML SSO (7 by aaronpk, dlozlla, gffletch, mcguinness)
    https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/94 
  - #93 Prior art for future revisions (2 by GoetzGW, JayDaley)
    https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/93 

* oauth-wg/draft-ietf-oauth-client-id-metadata-document (+3/-0/💬0)
  3 issues created:
  - Section 4.5 Redirect URIs (by ThisIsMissEm)
    https://github.com/oauth-wg/draft-ietf-oauth-client-id-metadata-document/issues/81 [enhancement] 
  - Privacy Considerations Section (by ThisIsMissEm)
    https://github.com/oauth-wg/draft-ietf-oauth-client-id-metadata-document/issues/80 
  - Review from Justin Richer (by ThisIsMissEm)
    https://github.com/oauth-wg/draft-ietf-oauth-client-id-metadata-document/issues/79 



Pull requests
-------------
* oauth-wg/oauth-identity-chaining (+0/-0/💬2)
  1 pull requests received 2 new comments:
  - #190 Genart lc review (2 by bc-pi)
    https://github.com/oauth-wg/oauth-identity-chaining/pull/190 

* oauth-wg/oauth-transaction-tokens (+3/-0/💬1)
  3 pull requests submitted:
  -  (by PieterKas)
     
  -  (by gffletch)
     
  -  (by gffletch)
     

  1 pull requests received 1 new comments:
  - #345 Clarify transaction tokens vs OAuth 2.0 access tokens (1 by bc-pi)
    https://github.com/oauth-wg/oauth-transaction-tokens/pull/345 

* oauth-wg/draft-ietf-oauth-attestation-based-client-auth (+4/-0/💬0)
  4 pull requests submitted:
  -  (by paulbastian)
     
  -  (by paulbastian)
     
  -  (by paulbastian)
     
  -  (by paulbastian)
     


Repositories tracked by this digest:
-----------------------------------
* https://github.com/oauth-wg/oauth-browser-based-apps
* https://github.com/oauth-wg/oauth-identity-chaining
* https://github.com/oauth-wg/oauth-transaction-tokens
* https://github.com/oauth-wg/oauth-sd-jwt-vc
* https://github.com/oauth-wg/draft-ietf-oauth-resource-metadata
* https://github.com/oauth-wg/oauth-cross-device-security
* https://github.com/oauth-wg/oauth-selective-disclosure-jwt
* https://github.com/oauth-wg/oauth-v2-1
* https://github.com/oauth-wg/draft-ietf-oauth-status-list
* https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth
* https://github.com/oauth-wg/oauth-identity-assertion-authz-grant
* https://github.com/oauth-wg/draft-ietf-oauth-rfc8725bis
* https://github.com/oauth-wg/draft-ietf-oauth-rfc7523bis
* https://github.com/oauth-wg/oauth-first-party-apps
* https://github.com/oauth-wg/draft-ietf-oauth-client-id-metadata-document


-- 
To have a summary like this sent to your list, see: https://github.com/ietf-github-services/activity-summary