[Txauth] Getting Started

[Justin Richer <[e-mail]>]

Hi everyone, thanks for joining the TXAuth list. We’ve got a BoF proposed for Singapore, with a confirmed BoF chair and a couple confirmed presenters. With that, I wanted to take a few minutes to go over some things.

1) Why something new?

I’ve presented about this very topic a few times [1][2], but the short of it is that the incredibly successful OAuth 2 protocol is reaching its edges. We’re doing things with it now that we never envisioned a decade ago, and we’re consistently seeing people wanting to use it for things that it can’t do, also. I’m arguing that we should really take a bit to step back from our assumptions and try to solve today’s problems in a clean and consistent manner, and that we’ll have a better solution for it.

2) Why isn’t this on the OAuth list?

The things that we’re discussing in TXAuth are inspired by many things in OAuth and its ecosystem, but it’s clear that this is new work and not an extension to OAuth 2. What isn’t clear is exactly where this work is going to happen, and we wanted to separate the conversation about new stuff into its own space, at least for now. If we end up rechartering the OAuth WG to include this work, we’ll move the conversation back over there instead.

3) Is this just an effort to stamp “standard” on XYX?

The XYZ project (https://oauth.xyz/) is my early attempt at building a protocol that combined the goals of a number of different aspects of the OAuth 2 ecosystem into a single protocol. I am going to submit XYZ as consideration for the starting document of whatever we end up working on. I really like the structure and patterns in XYZ, and believe there’s a lot we can learn from its design, but I have no illusions of this draft being the final product.

4) Is this the end of  OAuth 2 (or OIDC or UMA or …)?

Hardly. OAuth 2 does a job and handles it well, and I genuinely don’t think it’s going to disappear overnight. And there’s a lot of good work happening to bring OAuth into the modern world, particularly the combination of PAR/RAR/JAR. Even so, I think we can build something without the chains of backwards-compatibility that will be both simpler and more capable, and that’s what this list and related work is for.

5) Is this OAuth 3?

Could be. Might be something else that’s either not OAuth or even not-authz-specific. That’s for a working group to decide — whether the OAuth WG (after a recharter) or a new WG (if it’s founded after the BoF).


Thanks everyone, and I hope to see you in Singapore!

— Justin