The Use of Attestation in OAuth 2.0 Dynamic Client Registration
draft-tschofenig-oauth-attested-dclient-reg-01
| Document | Type |
Expired Internet-Draft
(individual)
Expired & archived
|
|
|---|---|---|---|
| Authors | Hannes Tschofenig , Jan Herrmann , Ned Smith , Thomas Hardjono | ||
| Last updated | 2024-04-25 (Latest revision 2023-10-23) | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Expired | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
The OAuth 2.0 Dynamic Client Registration specification described in RFC 7591 describes how an OAuth 2.0 client can be dynamically registered with an authorization server to obtain information to interact with this authorization server, including an OAuth 2.0 client identifier. To offer proper security protection for this dynamic client registration some security credentials need to be available on the OAuth 2.0 client. For this purpose RFC 7591 relies on two mechanisms, a trust-on-first-use model and a model where the client is in possession of a software statement (a sort-of bearer token). This specification improves the security of the OAuth 2.0 Dynamic Client Registration specification by introducing the support of attestation.
Authors
Hannes Tschofenig
Jan Herrmann
Ned Smith
Thomas Hardjono
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)