Hi, Pieter, Sean and I have published an updated draft of oauth-txn-token-chaining-profile which describes how to use a transaction token to cross a trust domain boundary. The GitHub repository for the work can be found here: https://github.com/gffletch/tt_xdomain
Feedback on list or via issues is greatly appreciated. This is a key capability for deployments that are leveraging transaction tokens as the downstream workload may only have a transaction token and it needs to exchange it for the necessary tokens in order to invoke an API in another/different trust domain. P.S. This draft replaces draft-fletcher-transaction-token-chaining-profile-02 Thanks, George Fletcher Identity Standards Architect Practical Identity LLC > Begin forwarded message: > > From: [email protected] > Subject: New Version Notification for > draft-fletcher-oauth-txn-token-chaining-profile-00.txt > Date: September 10, 2026 at 12:41:45 PM EDT > To: "George Fletcher" <[email protected]>, "Pieter Kasselman" > <[email protected]>, "Sean O'Dell" <[email protected]> > > A new version of Internet-Draft > draft-fletcher-oauth-txn-token-chaining-profile-00.txt has been successfully > submitted by George Fletcher and posted to the > IETF repository. > > Name: draft-fletcher-oauth-txn-token-chaining-profile > Revision: 00 > Title: Transaction Token Authorization Grant Profile for OAuth Identity > and Authorization Chaining > Date: 2026-09-10 > Group: Individual Submission > Pages: 31 > URL: > https://www.ietf.org/archive/id/draft-fletcher-oauth-txn-token-chaining-profile-00.txt > Status: > https://datatracker.ietf.org/doc/draft-fletcher-oauth-txn-token-chaining-profile/ > HTML: > https://www.ietf.org/archive/id/draft-fletcher-oauth-txn-token-chaining-profile-00.html > HTMLized: > https://datatracker.ietf.org/doc/html/draft-fletcher-oauth-txn-token-chaining-profile > > > Abstract: > > This specification defines a profile of the OAuth Identity and > Authorization Chaining Across Domains > [I-D.ietf-oauth-identity-chaining] mechanism that uses a Transaction > Token (Txn-Token) [I-D.ietf-oauth-transaction-tokens] as the subject > token in a Token Exchange [RFC8693] request to obtain a JWT > Authorization Grant for crossing a trust boundary. > > A Txn-Token is scoped to a single trust domain and represents the > full authorization context of an in-progress transaction, regardless > of whether that transaction was initiated by a human user calling an > external API, by an internal system event, or by an automated > workload. This profile specifies how a service operating within that > trust domain can present its Txn-Token to obtain a JWT Authorization > Grant that carries the necessary context across a trust boundary, > enabling an access token to be issued for a partner service, without > exposing internal trust-domain credentials or token formats beyond > the trust boundary. > > > > The IETF Secretariat > >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
