[OPS-DIR]Re: draft-ietf-oauth-rfc7523bis-07 ietf last call Opsdir review

[[e-mail]]

Hi Luigi,

Thank you for the review and for flagging the need to address interop issues.

FYI, I balloted No-Obj for this document: https://mailarchive.ietf.org/arch/msg/oauth/SjAn38U6bLhVKNxRLm2KKrZRQUM/.

Cheers,
Med

De : Brian Campbell <bcampbell=[e-mail]>
Envoyé : jeudi 16 avril 2026 20:15
À : Luigi Iannone <[e-mail]>
Cc : [e-mail]; [e-mail]; [e-mail]; [e-mail]
Objet : [OPS-DIR]Re: draft-ietf-oauth-rfc7523bis-07 ietf last call Opsdir review


Hi Luigi,

Draft -08 now has an Operational Considerations section that attempts to explain the relevant inter-version compatibility situation: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rfc7523bis-08#name-operational-considerations

On Wed, Apr 15, 2026 at 12:51 PM Brian Campbell <[e-mail]<mailto:[e-mail]>> wrote:
Thank you for the review Luigi.

The secdir review also highlighted the need for improved treatment of migration and interoperability considerations. A new "Operational Considerations" section seems like an appropriate place for that content. I added a comment to the issue tracking the secdir review https://github.com/oauth-wg/draft-ietf-oauth-rfc7523bis/issues/28.

Usage of the new media type is specified in https://www.ietf.org/archive/id/draft-ietf-oauth-rfc7523bis-07.html#section-4-5.1.1 and shown in the example https://www.ietf.org/archive/id/draft-ietf-oauth-rfc7523bis-07.html#section-4.1-6. Whether or not this is a great use of media types is, to me anyway, a reasonable question https://mailarchive.ietf.org/arch/msg/oauth/IRYjOn88hDh-Rk1i9R-fIyznMnA/ but one that is not in scope of this draft.


On Wed, Apr 15, 2026 at 2:31 AM Luigi Iannone via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:
Document: draft-ietf-oauth-rfc7523bis
Title: Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and
Assertion-Based Authorization Grants Reviewer: Luigi Iannone Review result: Has
Issues

Hi,

I have been selected as the Operational Directorate (opsdir) reviewer for this
Internet-Draft.

The Operational Directorate reviews all operational and management-related
Internet-Drafts to ensure alignment with operational best practices and that
adequate operational considerations are covered.

A complete set of _"Guidelines for Considering Operations and Management in
IETF Specifications"_ can be found at
https://datatracker.ietf.org/doc/draft-ietf-opsawg-rfc5706bis/.

While these comments are primarily for the Operations and Management Area
Directors (Ops ADs), the authors should consider them alongside other feedback
received.

- Document: draft-ietf-oauth-rfc7523bis-07

- Reviewer: Luigi Iannone

- Review Date: 15 April 2026

- Intended Status: Standards Track

---

## Summary

- Has Issues: I have some minor concerns about this document that I think
should be resolved before publication.

## General Operational Comments Alignment with RFC 5706bis

This document is basically a security fix for RFC7521, RFC7522, RFC7523 and RFC
9126, all of them are updated by this document. In particular it fixes
ambiguities in the audience values in tokens sent from a client to an
authorization server.

Beside the specifications themselves, there are clear operational consequences,
and while RFC7521, RFC7522, RFC7523 have an "Interoperability Considerations"
this document (at revision -07) does discuss at all operational aspects.

## Major Issues

I suggest (in accordance to 5706bis - see link above) to add an "Operational
Considerations" section covering the following missing points:

- Interoperability aspects. Discuss any interoperability aspect that changes
(or not) with respect to the RFCs that are updated.

- Migration path: How to make sure that both client and server both support
this document? What happens if it is not the case (only one end supports this
document but the other end does not)?

- Any change in the management aspects (parameters agreement)? Is there any
operational change that needs to be explicitly stated?

---

## Minor Issues

In the IANA Section it is requested to register a new media type, but the
document does explicitly states where and when to use such media type. Please
add a short description with references to the relevant RFCs.

---



CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.