I closed the issue, since the Deferred Token Response option that Brian pointed out would probably be sufficient if this is needed.
On Tue, Oct 27, 2026 at 4:06 PM Brian Campbell <bcampbell= [email protected]> wrote: > I started discussing in the issue: > https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/139#issuecomment-6454962489 > [github.com] > <https://urldefense.com/v3/__https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/139*issuecomment-6454962489__;Iw!!BmdzS3_lV9HdKG8!1B8XK-y_TOsZLlWIZnoJltwP8jktLscb1bWR2_VE9-C3FtAwhna56cE7RUqogUFhenwz0LKXwwTP_4XRasYcBVXX0BR6k7PgUzLLt2AIkRk$> > > On Tue, Oct 27, 2026 at 10:50 AM Atul Tulshibagwale <atul.tulshibagwale= > [email protected]> wrote: > >> Hi all, >> Issuing an ID-JAG is an event that conveys a user identity most often >> across organizational boundaries. In a way, it is like indirectly issuing >> an access token. >> >> I can see consumer scenarios where this might require user consent. >> However, I don't know if the current draft allows for that. >> >> I've filed this issue to discuss it: >> https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/139 >> [github.com] >> <https://urldefense.com/v3/__https://github.com/oauth-wg/oauth-identity-assertion-authz-grant/issues/139__;!!BmdzS3_lV9HdKG8!1B8XK-y_TOsZLlWIZnoJltwP8jktLscb1bWR2_VE9-C3FtAwhna56cE7RUqogUFhenwz0LKXwwTP_4XRasYcBVXX0BR6k7PgUzLLVmPiLIo$> >> >> Atul >> >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited. > If you have received this communication in error, please notify the sender > immediately by e-mail and delete the message and any file attachments from > your computer. Thank you.*
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
