Subject: Last Call: <draft-ietf-oauth-mtls-15.txt> (OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens) to Proposed Standard

From: The IESG <[email-masked]>
Date: Thu, 11 Jul 2019 15:00:24 -0700

The IESG has received a request from the Web Authorization Protocol WG
(oauth) to consider the following document: - 'OAuth 2.0 Mutual TLS Client
Authentication and Certificate-Bound
   Access Tokens'
  <draft-ietf-oauth-mtls-15.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2019-08-01. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract

   This document describes OAuth client authentication and certificate-
   bound access and refresh tokens using mutual Transport Layer Security
   (TLS) authentication with X.509 certificates.  OAuth clients are
   provided a mechanism for authentication to the authorization server
   using mutual TLS, based on either self-signed certificates or public
   key infrastructure (PKI).  OAuth authorization servers are provided a
   mechanism for binding access tokens to a client's mutual TLS
   certificate, and OAuth protected resources are provided a method for
   ensuring that such an access token presented to it was issued to the
   client presenting the token.

The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-oauth-mtls/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-oauth-mtls/ballot/

No IPR declarations have been submitted directly on this I-D.