OAuth SPIFFE Client Authentication
draft-schwenkschuster-oauth-spiffe-client-auth-01
| Document | Type |
Replaced Internet-Draft
(candidate for oauth WG)
Expired & archived
|
|
|---|---|---|---|
| Authors | Arndt Schwenkschuster , Pieter Kasselman , Scott Rose | ||
| Last updated | 2025-11-13 (Latest revision 2025-10-03) | ||
| Replaced by | draft-ietf-oauth-spiffe-client-auth | ||
| RFC stream | Internet Engineering Task Force (IETF) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Additional resources | Mailing list discussion | ||
| Stream | WG state | Call For Adoption By WG Issued | |
| Document shepherd | (None) | ||
| IESG | IESG state | Replaced by draft-ietf-oauth-spiffe-client-auth | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
This specification profiles the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [RFC7521] and JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants [RFC7523] to enable the use of SPIFFE Verifiable Identity Documents (SVIDs) as client credentials in OAuth 2.0. It defines how OAuth clients with SPIFFE credentials can authenticate to OAuth authorization servers using their JWT-SVIDs or X.509-SVIDs without the need for client secrets. This approach enhances security by enabling seamless integration between SPIFFE-enabled workloads and OAuth authorization servers while eliminating the need to distribute and manage shared secrets such as static client secrets.
Authors
Arndt Schwenkschuster
Pieter Kasselman
Scott Rose
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)