[Wimse] Re: Request for Input: Best Current Practice for OAuth 2.0 Client Authentication in Workload Environments

[John Kemp <[e-mail]>]

I also favour option A for the same reasons. I do think it's worth 
documenting current practices, since it provides background motivation, 
especially as related to mitigating potential issues with current 
practice, which is, I think, the raison d'être of this group.

Regards,

- johnk

On 7/29/24 6:17 PM, Flemming Andreasen (fandreas) wrote:
> Given the choices, I would go for option A (i.e. no specific 
> recommendations), the reason being I don't think it makes a lot of sense 
> for WIMSE to recommend one thing based purely on OAuth access tokens, 
> when we may end up specifying something different using WIMSE tokens (or 
> whatever we end up calling it). I do think pointing out potential issues 
> with current mechanisms would be helpful though.
> 
> Thanks
> 
> -- Flemming
> 
> 
> On 7/29/24 06:21, Pieter Kasselman wrote:
>>
>> During the Working Group meeting in Vancouver there was discussion on 
>> the scope of the Working Group document titled Best Current Practice 
>> for OAuth 2.0 Client Authentication in Workload Environments [1], 
>> which was adopted in accordance with the following deliverable in the 
>> charter [2]:
>>
>>   * [I or BCP] Document and make recommendations based on operational
>>     experience to existing token distribution practices for workloads.
>>
>> This is intended to respond to the following milestone [3]:
>>
>>   * Submit informational document describing considerations for
>>     filesystem-based JWT delivery in Kubernetes to the IESG
>>
>> Please reply to the list to indicate which of the following options 
>> represent the appropriate scope for this document:
>>
>>  1. Document existing practices without specific recommendations on
>>     how to obtain, protect and use OAuth Access Tokens.
>>  2. Document existing practices along with strong recommendations on
>>     how to obtain, protect and use OAuth Access Tokens.
>>  3. Need more information (please state what more information you need).
>>  4. No opinion (i.e., this isn’t a topic you care strongly about).
>>
>>
>> Please reply to the list by August 12th, 2024.
>>
>> Thank you,
>>
>> Pieter and Justin
>>
>> [1] 
>> https://datatracker.ietf.org/doc/draft-ietf-wimse-workload-identity-bcp/
>>
>> [2] https://datatracker.ietf.org/doc/charter-ietf-wimse/
>>
>> [3] https://datatracker.ietf.org/wg/wimse/about/
>>
>>
> 
>