[Wimse] Re: Request for Input: Best Current Practice for OAuth 2.0 Client Authentication in Workload Environments

[Andrii Deinega <[e-mail]>]

Pieter, I choose to go with C.

ATs need to be protected from replay attacks, there must be a proof of
possession mechanism in place, without that we can't simply refer to it as
BCP.

https://mailarchive.ietf.org/arch/msg/wimse/HeF1jAzR6p1BPT_jx_6MuLN7WM0 is
also my feedback on this document.

All the best,
Andrii


On Mon, Jul 29, 2024 at 3:17 PM Flemming Andreasen (fandreas) <fandreas=
[e-mail]> wrote:

> Given the choices, I would go for option A (i.e. no specific
> recommendations), the reason being I don't think it makes a lot of sense
> for WIMSE to recommend one thing based purely on OAuth access tokens, when
> we may end up specifying something different using WIMSE tokens (or
> whatever we end up calling it). I do think pointing out potential issues
> with current mechanisms would be helpful though.
>
> Thanks
>
> -- Flemming
>
>
> On 7/29/24 06:21, Pieter Kasselman wrote:
>
> During the Working Group meeting in Vancouver there was discussion on the
> scope of the Working Group document titled Best Current Practice for OAuth
> 2.0 Client Authentication in Workload Environments [1], which was adopted
> in accordance with the following deliverable in the charter [2]:
>
>
>
>    - [I or BCP] Document and make recommendations based on operational
>    experience to existing token distribution practices for workloads.
>
>
>
> This is intended to respond to the following milestone [3]:
>
>
>
>    - Submit informational document describing considerations for
>    filesystem-based JWT delivery in Kubernetes to the IESG
>
>
>
> Please reply to the list to indicate which of the following options
> represent the appropriate scope for this document:
>
>
>
>    1. Document existing practices without specific recommendations on how
>    to obtain, protect and use OAuth Access Tokens.
>    2. Document existing practices along with strong recommendations on
>    how to obtain, protect and use OAuth Access Tokens.
>    3. Need more information (please state what more information you need).
>    4. No opinion (i.e., this isn’t a topic you care strongly about).
>
>
> Please reply to the list by August 12th, 2024.
>
>
>
> Thank you,
>
>
>
> Pieter and Justin
>
>
>
> [1]
> https://datatracker.ietf.org/doc/draft-ietf-wimse-workload-identity-bcp/
>
> [2] https://datatracker.ietf.org/doc/charter-ietf-wimse/
>
> [3] https://datatracker.ietf.org/wg/wimse/about/
>
>
>
>
> --
> Wimse mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>