[saag] OAuth Summary

[Hannes Tschofenig <[e-mail]>]

We started the OAuth meeting with a discussion about
the current status. The group is making good progress.

* Four documents are currently in the RFC Editor Queue, namely the OAuth
assertion framework, JWT Bearer Assertions, SAML Bearer Assertions and
the JSON Web Token (JWT).

* Two documents are currently in IETF processing, namely the
Dynamic Client Registration and the Dynamic Client
Registration Management protocols.

* Three other documents are about to be sent to the IESG any day
now, namely token introspection, the proof-of-possession
architecture and the Proof Key for Code Exchange.

The main part of the meeting was spent on the discussion of
the proof-of-possession solution components, namely draft-ietf-
oauth-signed-http-request, draft-ietf-oauth-pop-key-
distribution, and draft-ietf-oauth-proof-of-possession. A
design question regarding the support of proof-of-possession
support for refresh tokens was raised during the meeting and
further analysis is needed to resolve the issue.

Two new documents have been presented to the audience, namely
* JWT Destination Claim: draft-campbell-oauth-dst4jwt, and
* Open Redirector: draft-bradley-oauth-open-redirector

The security problems (based on actual attacks) described in the Open
Redirector document raised the question about the best way to offer
security guidance in the OAuth WG.

A few participants from the working group met Wednesday
evening to discuss next steps regarding the token exchange
specification.