Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Christer Holmberg <[e-mail]>]

Hi,

>The tokens generally, but if I understand it right not always, are JWT structures that contain various data.
>Found a draft that specifies an Oauth Access Token JWT profile
>https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-00
>
>"The original OAuth 2.0 Authorization Framework [https://tools.ietf.org/html/rfc6749]
>   specification does not mandate any specific format for access tokens.
>   While that remains perfectly appropriate for many important scenario,
>   in-market use has shown that many commercial OAuth2 implementations
>   elected to issue access tokens using a format that can be parsed and
>   validated by resource servers directly, without further authorization
>   server involvement.  The approach is particularly common in
>   topologies where the authorization server and resource server are not
>   co-located, are not ran by the same entity, or are otherwise
>   separated by some boundary.  All of the known commercial
>   implementations known at this time leverage the JSON Web Tokens(JWT)
>   [https://tools.ietf.org/html/rfc7519] format.
>“
>
> I think we can safely assume that an Access Token is going to be parsable.

The question is whether we want to mandate JWT, eventhough the statement above probably is correct.

Regards,

Christer