Hi all, We have posted -01 of the Deferred Token Response draft: https://www.ietf.org/archive/id/draft-ietf-oauth-deferred-token-response-01.html
The main change in this version is that the integration with JAG-IR is now nearly complete. The draft defines the interactive redirect flow: - The interaction_required state and the interaction_uri response parameter (#49). - The interaction_pending error code (#68) and its IANA registration (#77). - The deferred_interactive completion mode (#71). - The use cases covering the JAG-IR scenarios (#69). Other changes since -00: - Updated the Overview section to cover the interaction states (#74). - Added a reference to RFC 9126 (PAR) (#78). - Added implementation considerations on 128-bit entropy (#70). Remaining issue: #79: how redirect_uri should be handled in the JAG-IR flow. The PR adds redirect_uri to the token request, so that, after the user completes the interaction, the authorization server redirects the browser back to the client as a completion signal only. The open question is: redirect_uri was originally designed for JAG-IR, and extending it to other grant types (e.g., authorization_code, which already has a redirect_uri) raises parameter compatibility issues that need more thought. The PR is open and needs broader discussion at IETF 127. PRs referenced above: #49 https://github.com/oauth-wg/oauth-deferred-token-response/pull/49 #68 https://github.com/oauth-wg/oauth-deferred-token-response/pull/68 #69 https://github.com/oauth-wg/oauth-deferred-token-response/pull/69 #70 https://github.com/oauth-wg/oauth-deferred-token-response/pull/70 #71 https://github.com/oauth-wg/oauth-deferred-token-response/pull/71 #74 https://github.com/oauth-wg/oauth-deferred-token-response/pull/74 #77 https://github.com/oauth-wg/oauth-deferred-token-response/pull/77 #78 https://github.com/oauth-wg/oauth-deferred-token-response/pull/78 #79 https://github.com/oauth-wg/oauth-deferred-token-response/pull/79 Dapeng Liu ------------------------------------------------------------------ 发件人：<[email protected]> 日 期：2026年11月01日 00:12:17 收件人：<[email protected]> 抄 送：<[email protected]> 主 题：[OAUTH-WG] I-D Action: draft-ietf-oauth-deferred-token-response-01.txt Internet-Draft draft-ietf-oauth-deferred-token-response-01.txt is now available. It is a work item of the Web Authorization Protocol (OAUTH) WG of the IETF. Title: Deferred Token Response Authors: Guilherme de Oliveira Niero Dapeng Liu Name: draft-ietf-oauth-deferred-token-response-01.txt Pages: 47 Dates: 2026-10-31 Abstract: This document defines the Deferred Token Response (DTR) extension for OAuth 2.1. In existing OAuth grants, the token endpoint either issues an access token or returns an error. DTR establishes a generic asynchronous token request mechanism that any OAuth grant may plug into. In DTR-aware flows, the authorization server returns a deferral_code and a polling interval, indicating that the final token response will be available at a later time. The client retrieves the eventual response by polling the token endpoint, or by receiving a callback from the authorization server when one is configured. The IETF datatracker status page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-oauth-deferred-token-response/ There is also an HTML version available at: https://www.ietf.org/archive/id/draft-ietf-oauth-deferred-token-response-01.html A diff from the previous version is available at: https://author-tools.ietf.org/iddiff?url2=draft-ietf-oauth-deferred-token-response-01 Internet-Drafts are also available by rsync at: rsync.ietf.org::internet-drafts _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
