OAuth 2.0 Client Intermediary Metadata
draft-parecki-oauth-client-intermediary-metadata-03
|
Document |
Type |
|
Active Internet-Draft (individual)
|
|
Author |
|
Aaron Parecki
|
|
Last updated |
|
2021-02-22
|
|
Stream |
|
(None)
|
|
Intended RFC status |
|
(None)
|
|
Formats |
|
plain text
xml
pdf
htmlized (tools)
htmlized
bibtex
|
Stream |
Stream state |
|
(No stream defined) |
|
Consensus Boilerplate |
|
Unknown
|
|
RFC Editor Note |
|
(None)
|
IESG |
IESG state |
|
I-D Exists
|
|
Telechat date |
|
|
|
Responsible AD |
|
(None)
|
|
Send notices to |
|
(None)
|
Open Authentication Protocol A. Parecki
Internet-Draft Okta
Intended status: Standards Track February 22, 2021
Expires: August 26, 2021
OAuth 2.0 Client Intermediary Metadata
draft-parecki-oauth-client-intermediary-metadata-03
Abstract
This specification defines a mechanism for including information
about additional parties involved in an OAuth transaction by adding a
new section to the OAuth 2.0 Dynamic Client Registration request, as
well as requires that authorization servers surface this information
to users during an OAuth transaction.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 26, 2021.
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Parecki Expires August 26, 2021 [Page 1]
Internet-Draft OAuth 2.0 Client Intermediary Metadata February 2021
1. Introduction
In some applications of OAuth, there may be multiple legal entities
which have access to or process data retrieved by an OAuth client.
In the traditional OAuth model, a "client_id" represents only a
single application, and so the OAuth consent screen lists just one
third party: the OAuth client.
In this situation, in order to comply with various local laws and
regulations, the user needs to be informed by the authorization
server of the list of entities that will have access to their data
after authorizing the client.
The existing Dynamic Client Registration ([RFC7591]) specification
lacks a mechanism for communicating a list of additional parties that
may have access to the user's data.
This specification extends [RFC7591] and [RFC7592] to define a
mechanism for including information about the additional parties
involved in an OAuth transaction by including information about the
additional intermediaries into the Dynamic Client Registration
request. This specification also defines requirements of the OAuth
authorization server to present this information about the additional
parties in the OAuth consent screen during an OAuth transaction.
2. Notational Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
[RFC2119].
Unless otherwise noted, all the protocol parameter names and values
are case sensitive.
3. Terminology
In addition to the terms defined in referenced specifications, this
document uses the following terms:
"OAuth": In this document, "OAuth" refers to OAuth 2.0, [RFC6749].
"Client": "Client" has the same definition as in OAuth 2.0, but is
worth pointing out that the client in this context may be operated
by a different legal entity than is described by the client name.
"Intermediary": One or more entities that the user's data will pass
through or be shared with by using the OAuth client. This
Parecki Expires August 26, 2021 [Page 2]
Internet-Draft OAuth 2.0 Client Intermediary Metadata February 2021
information is voluntarily provided by the OAuth client, and is
typically enforced by a business relationship between the
organization providing the Client and the organization providing
the Resource Server.
4. Client Intermediary Metadata
Registered client intermediaries have a set of metadata values
associated with the client identifier of the client that represents
them in the OAuth transaction, such as a user-visible name, logo, and
Show full document text