datatracker.ietf.org
Sign in
Version 5.6.4.p1, 2014-10-20
Report a bug

Web Authorization Protocol (oauth)

Group
Name: Web Authorization Protocol
Acronym:oauth
Area:Security Area (sec)
State: Active
Charter: charter-ietf-oauth-04 (Approved)
Personnel
Chairs: Hannes Tschofenig <Hannes.Tschofenig@gmx.net>
Derek Atkins <derek@ihtfp.com>
Area Director: Kathleen Moriarty <Kathleen.Moriarty.ietf@gmail.com>
Mailing List
Address:oauth@ietf.org
To Subscribe:https://www.ietf.org/mailman/listinfo/oauth
Archive:http://www.ietf.org/mail-archive/web/oauth/
Jabber Chat
Room Address: xmpp:oauth@jabber.ietf.org
Logs: http://jabber.ietf.org/logs/oauth/

Charter for Working Group


The Web Authorization (OAuth) protocol allows a user to grant a
third-party Web site or application access to the user's protected
resources, without necessarily revealing their long-term credentials,
or even their identity. For example, a photo-sharing site that
supports OAuth could allow its users to use a third-party printing Web
site to print their private pictures, without allowing the printing
site to gain full control of the user's account and without having the
user share his or her photo-sharing sites' long-term credential with
the printing site.

The OAuth protocol suite encompasses

* a procedure for allowing a client to discover an authorization
server,
* a protocol for obtaining authorization tokens from an authorization
server with the resource owner's consent,
* protocols for presenting these authorization tokens to protected
resources for access to a resource, and
* consequently for sharing data in a security and privacy respective
way.

The working group also developed security schemes for presenting
authorization tokens to access a protected resource. This led to the
publication of the bearer token, as well as work that remains to be
completed on message authentication code (MAC) access authentication
and SAML assertions to interwork with existing identity management
solutions. The working group will complete those remaining documents,
and will also complete documentation of the OAuth threat model that
was started under the previous charter.

The ongoing standardization effort within the OAuth working group will
focus on enhancing interoperability of OAuth deployments. A standard
for a token revocation service, which can be separated from the
existing web tokens to the token repertoire will enable wider
deployment of OAuth. Extended documentation of OAuth use cases will
enhance the understanding of the OAuth framework and provide
assistance to implementors. And dynamic client registration will make
it easier to broadly deploy OAuth clients (performing services to
users).

Milestones

Done
Submit 'The OAuth 2.0 Protocol: Bearer Tokens' to the IESG for consideration as a Proposed Standard
Done
Submit 'The OAuth 2.0 Authorization Protocol' to the IESG for consideration as a Proposed Standard
Done
Submit 'An IETF URN Sub-Namespace for OAuth' to the IESG for consideration as a Proposed Standard
Done
Submit 'OAuth 2.0 Threat Model and Security Considerations' to the IESG for consideration as an Informational RFC
Done
Submit 'Token Revocation' to the IESG for consideration as a Proposed Standard
Done
Submit 'OAuth 2.0 Assertion Profile' to the IESG for consideration as a Proposed Standard
draft-ietf-oauth-assertions
Done
Submit 'SAML 2.0 Bearer Assertion Profiles for OAuth 2.0' to the IESG for consideration as a Proposed Standard
draft-ietf-oauth-saml2-bearer
Done
Submit 'JSON Web Token (JWT)' to the IESG for consideration as a Proposed Standard
draft-ietf-oauth-json-web-token
Done
Submit 'JSON Web Token (JWT) Bearer Token Profiles for OAuth 2.0' to the IESG for consideration as a Proposed Standard
draft-ietf-oauth-jwt-bearer
Jul 2014
Submit 'OAuth Dynamic Client Registration Protocol' to the IESG for consideration as a Proposed Standard
draft-ietf-oauth-dyn-reg

+ 1 new milestone currently in Area Director review.