Pedram, Yes, I'm interested, and I'd support a separate document.
One request on scope. Section 2.4 leaves open whether the broker hands the access it obtains to its downstream clients or keeps the tokens and makes the upstream calls itself. I think the new document should name both patterns. The shared-consent risk applies to both, since in both the AS sees one client. The second pattern adds a risk of its own: concentration. The broker holds many users' refresh tokens and the clients (in my case AI agents) never see them, so what matters is who can cause a call, how that authority is narrowed and revoked, and what the broker records about each call. That is the shape draft-sweeney-wimse-credential-delegation profiles. If the document goes ahead I'm happy to contribute it as a worked deployment pattern with its security considerations. Kieran On Mon, Oct 19, 2026 04:50 AM, Pedram Hosseyni < [email protected]> wrote: > Dear all, > > At IETF 126, we presented a new section in the draft updating the > Security BCP, covering shared consent in brokered OAuth. [1] > > We discussed whether brokered OAuth architectures, including common > deployment patterns and their security considerations should be > addressed in a separate document. The current Section 2.4 of the BCP > Update draft [2] could be moved to the new document. > > Would there be interest in creating such a document? > > Best, > Pedram > > > [1] > https://datatracker.ietf.org/meeting/126/materials/slides-12 > 6-oauth-sessa-updates-to-oauth-20-security-best-current-practice-00 > [2] > https://datatracker.ietf.org/doc/draft-ietf-oauth-security-t > opics-update/03/ > > > -- > Dr. Pedram Hosseyni > Institute of Information Security - SEC > Universität Stuttgart > Universitätsstraße 38 > D-70569 Stuttgart > Germany > https://sec.uni-stuttgart.de > > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
