The OAuth 2.1 Authorization Framework
draft-ietf-oauth-v2-1-01
OAuth Working Group D. Hardt
Internet-Draft SignIn.Org
Intended status: Standards Track A. Parecki
Expires: 5 August 2021 Okta
T. Lodderstedt
yes.com
1 February 2021
The OAuth 2.1 Authorization Framework
draft-ietf-oauth-v2-1-01
Abstract
The OAuth 2.1 authorization framework enables a third-party
application to obtain limited access to an HTTP service, either on
behalf of a resource owner by orchestrating an approval interaction
between the resource owner and an authorization service, or by
allowing the third-party application to obtain access on its own
behalf. This specification replaces and obsoletes the OAuth 2.0
Authorization Framework described in RFC 6749.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 5 August 2021.
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
Hardt, et al. Expires 5 August 2021 [Page 1]
Internet-Draft The OAuth 2.1 Authorization Framework February 2021
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2. Protocol Flow . . . . . . . . . . . . . . . . . . . . . . 7
1.3. Authorization Grant . . . . . . . . . . . . . . . . . . . 8
1.3.1. Authorization Code . . . . . . . . . . . . . . . . . 8
1.3.2. Client Credentials . . . . . . . . . . . . . . . . . 9
1.4. Access Token . . . . . . . . . . . . . . . . . . . . . . 9
1.5. Refresh Token . . . . . . . . . . . . . . . . . . . . . . 10
1.6. TLS Version . . . . . . . . . . . . . . . . . . . . . . . 12
1.7. HTTP Redirections . . . . . . . . . . . . . . . . . . . . 12
1.8. Interoperability . . . . . . . . . . . . . . . . . . . . 12
1.9. Compatibility with OAuth 2.0 . . . . . . . . . . . . . . 13
1.10. Notational Conventions . . . . . . . . . . . . . . . . . 13
2. Client Registration . . . . . . . . . . . . . . . . . . . . . 14
2.1. Client Types . . . . . . . . . . . . . . . . . . . . . . 14
2.2. Client Identifier . . . . . . . . . . . . . . . . . . . . 16
2.3. Client Authentication . . . . . . . . . . . . . . . . . . 16
2.3.1. Client Password . . . . . . . . . . . . . . . . . . . 17
2.3.2. Other Authentication Methods . . . . . . . . . . . . 18
2.4. Unregistered Clients . . . . . . . . . . . . . . . . . . 18
3. Protocol Endpoints . . . . . . . . . . . . . . . . . . . . . 18
3.1. Authorization Endpoint . . . . . . . . . . . . . . . . . 19
3.1.1. Response Type . . . . . . . . . . . . . . . . . . . . 19
3.1.2. Redirection Endpoint . . . . . . . . . . . . . . . . 20
3.2. Token Endpoint . . . . . . . . . . . . . . . . . . . . . 22
3.2.1. Client Authentication . . . . . . . . . . . . . . . . 22
3.3. Access Token Scope . . . . . . . . . . . . . . . . . . . 23
4. Obtaining Authorization . . . . . . . . . . . . . . . . . . . 23
4.1. Authorization Code Grant . . . . . . . . . . . . . . . . 23
4.1.1. Authorization Request . . . . . . . . . . . . . . . . 25
4.1.2. Authorization Response . . . . . . . . . . . . . . . 28
4.1.3. Access Token Request . . . . . . . . . . . . . . . . 31
Show full document text