JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
draft-ietf-oauth-access-token-jwt-11
Document | Type | Active Internet-Draft (oauth WG) | |
---|---|---|---|
Author | Vittorio Bertocci | ||
Last updated | 2021-02-09 (latest revision 2021-01-22) | ||
Replaces | draft-bertocci-oauth-access-token-jwt | ||
Stream | IETF | ||
Intended RFC status | Proposed Standard | ||
Formats | plain text pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Hannes Tschofenig | ||
Shepherd write-up | Show (last changed 2020-10-08) | ||
IESG | IESG state | Waiting for Writeup | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Roman Danyliw | ||
Send notices to | Hannes Tschofenig <hannes.tschofenig@arm.com> | ||
IANA | IANA review state | IANA - Not OK | |
IANA expert review state | Reviews assigned |
OAuth Working Group V. Bertocci Internet-Draft Auth0 Intended status: Standards Track January 22, 2021 Expires: July 26, 2021 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens draft-ietf-oauth-access-token-jwt-11 Abstract This specification defines a profile for issuing OAuth 2.0 access tokens in JSON web token (JWT) format. Authorization servers and resource servers from different vendors can leverage this profile to issue and consume access tokens in interoperable manner. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on July 26, 2021. Copyright Notice Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Bertocci Expires July 26, 2021 [Page 1] Internet-Draft OAuth 2.0 Access Token JWT Profile January 2021 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Notation and Conventions . . . . . . . . . . 3 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2. JWT Access Token Header and Data Structure . . . . . . . . . 4 2.1. Header . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2. Data Structure . . . . . . . . . . . . . . . . . . . . . 4 2.2.1. Authentication Information Claims . . . . . . . . . . 5 2.2.2. Identity Claims . . . . . . . . . . . . . . . . . . . 5 2.2.3. Authorization Claims . . . . . . . . . . . . . . . . 6 2.2.3.1. Claims for Authorization Outside of Delegation Scenarios . . . . . . . . . . . . . . . . . . . . 6 3. Requesting a JWT Access Token . . . . . . . . . . . . . . . . 7 4. Validating JWT Access Tokens . . . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . 9 6. Privacy Considerations . . . . . . . . . . . . . . . . . . . 10 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 7.1. Media Type Registration . . . . . . . . . . . . . . . . . 12 7.1.1. Registry Content . . . . . . . . . . . . . . . . . . 12 7.2. Claims Registration . . . . . . . . . . . . . . . . . . . 13 7.2.1. Registry Contents . . . . . . . . . . . . . . . . . . 13 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . 15 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 15 Appendix B. Document History . . . . . . . . . . . . . . . . . . 16 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 20 1. Introduction The original OAuth 2.0 Authorization Framework [RFC6749] specification does not mandate any specific format for access tokens. While that remains perfectly appropriate for many important scenarios, in-market use has shown that many commercial OAuth 2.0 implementations elected to issue access tokens using a format that can be parsed and validated by resource servers directly, without further authorization server involvement. The approach is particularly common in topologies where the authorization server and resource server are not co-located, are not run by the same entity, or are otherwise separated by some boundary. At the time of writing, many commercial implementations leverage the JSON Web Tokens (JWT) [RFC7519] format. Many vendor specific JWT access tokens share the same functional layout, using JWT claims to convey the information needed to supportShow full document text