[Openid-specs-fapi] [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
torsten at lodderstedt.net
Sun Nov 13 03:33:38 UTC 2016
Hi John and Brian,
thanks for writting this draft.
One question: how does the AS determine the authentication method is TLS
authentication? I think you assume this is defined by the
client-specific policy, independent of whether the client is registered
automatically or manually. Would you mind to explicitely state this in
Am 11.10.2016 um 05:59 schrieb John Bradley:
> At the request of the OpenID Foundation Financial Services API Working
> group, Brian Campbell and I have documented
> mutual TLS client authentication. This is something that lots of
> people do in practice though we have never had a spec for it.
> The Banks want to use it for some server to server API use cases being
> driven by new open banking regulation.
> The largest thing in the draft is the IANA registration of
> “tls_client_auth” Token Endpoint authentication method for use in
> Registration and discovery.
> The trust model is intentionally left open so that you could use a
> “common name” and a restricted list of CA or a direct lookup of the
> subject public key against a reregistered value, or something in between.
> I hope that this is non controversial and the WG can adopt it quickly.
> John B.
>> Begin forwarded message:
>> *From: *internet-drafts at ietf.org <mailto:internet-drafts at ietf.org>
>> *Subject: **New Version Notification for
>> *Date: *October 10, 2016 at 5:44:39 PM GMT-3
>> *To: *"Brian Campbell" <brian.d.campbell at gmail.com
>> <mailto:brian.d.campbell at gmail.com>>, "John Bradley"
>> <ve7jtb at ve7jtb.com <mailto:ve7jtb at ve7jtb.com>>
>> A new version of I-D, draft-campbell-oauth-tls-client-auth-00.txt
>> has been successfully submitted by John Bradley and posted to the
>> IETF repository.
>> Title:Mutual X.509 Transport Layer Security (TLS) Authentication for
>> OAuth Clients
>> Document date:2016-10-10
>> Group:Individual Submission
>> This document describes X.509 certificates as OAuth client
>> credentials using Transport Layer Security (TLS) mutual
>> authentication as a mechanism for client authentication to the
>> authorization server's token endpoint.
>> Please note that it may take a couple of minutes from the time of
>> until the htmlized version and diff are available at tools.ietf.org
>> The IETF Secretariat
> OAuth mailing list
> OAuth at ietf.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-fapi