Dear OAuth-WG, We have published a new revision of the OAuth SPIFFE Client Authentication draft. This update includes improvements and suggestions based on feedback received from the working group since our meeting in Vienna. We plan on giving a short update on this at the next IETF meeting in 2 weeks.
Best regards, OAuth SPIFFE Client Authentication authors ---------- Forwarded message --------- From: <[email protected]> Date: Mon, Nov 2, 2026 at 6:36 PM Subject: New Version Notification for draft-ietf-oauth-spiffe-client-auth-03.txt To: Arndt Schwenkschuster <[email protected]>, Nancy Cam-Winget < [email protected]>, Pieter Kasselmann <[email protected]>, Scott Rose <[email protected]>, Stian Thorgersen <[email protected]> A new version of Internet-Draft draft-ietf-oauth-spiffe-client-auth-03.txt has been successfully submitted by Arndt Schwenkschuster and posted to the IETF repository. Name: draft-ietf-oauth-spiffe-client-auth Revision: 03 Title: OAuth SPIFFE Client Authentication Date: 2026-11-02 Group: oauth Pages: 30 URL: https://www.ietf.org/archive/id/draft-ietf-oauth-spiffe-client-auth-03.txt Status: https://datatracker.ietf.org/doc/draft-ietf-oauth-spiffe-client-auth/ HTML: https://www.ietf.org/archive/id/draft-ietf-oauth-spiffe-client-auth-03.html HTMLized: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-spiffe-client-auth Diff: https://author-tools.ietf.org/iddiff?url2=draft-ietf-oauth-spiffe-client-auth-03 Abstract: This specification profiles the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [RFC7521], the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants [RFC7523], and OAuth 2.0 Attestation-Based Client Authentication [I-D.draft-ietf-oauth-attestation-based-client-auth] to enable the use of SPIFFE Verifiable Identity Documents (SVIDs) as client credentials in OAuth 2.0. It defines how OAuth clients with SPIFFE credentials can authenticate to OAuth authorization servers using their JWT-SVIDs, WIT-SVIDs, or X509-SVIDs without the need for client secrets. This approach enhances security by enabling seamless integration between SPIFFE-enabled workloads and OAuth authorization servers while eliminating the need to distribute and manage shared secrets such as static client secrets. The IETF Secretariat
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
