> Dapeng, all, > > Yes to the direction. One question about where item 2 ends. > > For most requests the negotiation ends in a token with the right > fine-grained authority. For a high-consequence action the resource > server may need more: an approval of the exact parameters, by the > person, at the moment it runs. RFC 9470 lets the resource server ask > for stronger authentication, but not for that. Karl's Action-Bound > Approval section in draft-mcguinness-mission-runtime describes the > gate and leaves open how the approval is obtained. > > I've been working on one way to produce that evidence: a signature > on the user's own authenticator, gated by user verification, over a > canonical digest of the parameters (draft-yossif-psea-03, one > independent verifier so far). > > Is anyone else hitting this case: a valid token, the right scope, > and still a need to show that a person approved this specific > action? If so, it seems worth having the negotiation give the > resource server a defined way to ask for it. > > Mohamad
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
