Hi all, I've posted -02 of Attenuating Authorization Tokens (AATs): https://datatracker.ietf.org/doc/draft-niyikiza-oauth-attenuating-agent-tokens/
Since -01: - Twelve Internet-Drafts now cite AATs, and Appendix E lists 3 new independent implementations. - Section 8 specifies chain verification step by step, and -02 comes with 229 public test vectors for it: https://github.com/tenuo-ai/tenuo/blob/main/ietf/vectors/INTEROP.md - Section 1.3 describes how AATs complement transaction tokens, identity chaining and WIMSE's AIMS draft, and how they differ from Macaroons, SPKI/SDSI, Biscuit and UCAN. Appendix F lists the changes from -01, and the diff is here: https://author-tools.ietf.org/iddiff?url2=draft-niyikiza-oauth-attenuating-agent-tokens-02 Thanks to Neil Madden for the review of -01 on this list, and to everyone who reviewed and implemented -01. Reviews are welcome, especially of Section 8. If you're building agent delegation, I'd be glad to hear how AATs fit your deployment. Thanks, -Niki -- Niki Aimable Niyikiza Tenuo
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
