Hi all, Xiaoyi Zhang and I have submitted a new individual draft, OAuth Client IP Range Metadata:
https://datatracker.ietf.org/doc/draft-mcguinness-oauth-client-ip-ranges/ Many hosted OAuth clients send token requests from a known set of egress addresses. Enterprises often choose to restrict their token endpoints to those addresses, but today the ranges come from vendor-specific lists, each in its own format. For example, Atlassian publishes IP ranges, including egress ranges, at https://ip-ranges.atlassian.com/. Administrators must translate these lists into local allowlists and keep them updated. A standard way to declare these ranges is particularly useful with OAuth Client ID Metadata Documents, where clients can interact with an authorization server without prior registration. Declaring ranges in client metadata lets the authorization server obtain them directly. The draft defines two client metadata parameters, following the jwks/ jwks_uri pattern: - client_ip_ranges: IPv4 and IPv6 prefixes by value - client_ip_ranges_uri: an HTTPS URL of a JSON document with the prefixes, for large or frequently changing sets The parameters can be conveyed through Dynamic Client Registration and Client ID Metadata Documents, including in software statements. The draft also covers: - how authorization servers validate and accept declared ranges under local policy; - how retrieval failures and declaration withdrawal preserve existing restrictions; - recommended limits on retaining outdated sets. Declared ranges are an input to network access control. *They don't replace client authentication or sender-constrained tokens.* Editor's copy: https://mcguinness.github.io/draft-mcguinness-oauth-client-ip-ranges/draft-mcguinness-oauth-client-ip-ranges.html Repository: https://github.com/mcguinness/draft-mcguinness-oauth-client-ip-ranges Feedback on the approach and deployment use cases would be welcome, on the list or in the repository. Thanks, Karl
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
