Subject: [OAUTH-WG] OAuth 2.0 Pushed Authorization Requests: Implementation Status

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 24 Mar 2021 19:53:27 +0000

Hi all,

I am working on the shepherd writeup and I need information about the implementation status of this specification.

Can you share whether you are implementing, or planning to implement this specification? If there is open source, please drop a link to the mailing list. If you implement it in your product, please let us know as well.

This information helps the steering committee to judge the quality and maturity of the work.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Brian Campbell <[email-masked]>
Date: Wed, 24 Mar 2021 14:38:01 -0600

I pieced together an informal list of some implementations and usages for
an interim presentation last August. See slide 9 of
https://datatracker.ietf.org/meeting/interim-2020-oauth-11/materials/slides-interim-2020-oauth-11-sessa-par-00.pdf
for that. The mention of PingFederate on there was in beta at the time but
has since been officially released - look for PAR at
https://docs.pingidentity.com/bundle/pingfederate-102/page/qem1584122852896.html

Earlier today Taka mentioned a few other places PAR is being
used/implemented
https://mailarchive.ietf.org/arch/msg/oauth/oUcc0PuENDFSup0n0zK0bDnTHzA/
including the OpenID conformance suite already having test cases for it.

On Wed, Mar 24, 2021 at 1:53 PM Hannes Tschofenig <[email-masked]>
wrote:

> Hi all,
>
>
>
> I am working on the shepherd writeup and I need information about the
> implementation status of this specification.
>
>
>
> Can you share whether you are implementing, or planning to implement this
> specification? If there is open source, please drop a link to the mailing
> list. If you implement it in your product, please let us know as well.
>
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 24 Mar 2021 15:58:35 -0700

Hello Hannes!

I have implemented PAR a while ago in my open source project "Loginbuddy"
as documented here:
- documentation:
https://github.com/SaschaZeGerman/loginbuddy/wiki/Protocols-and-APIs
- endpoint: /pauthorize

I hope it hope,
Sascha

---

From: Filip Skokan <[email-masked]>
Date: Thu, 25 Mar 2021 10:40:47 +0100

Hello Hannes,

the Node.js open source oidc-provider project (
https://github.com/panva/node-oidc-provider) implements PAR behind a
feature flag

Best,
*Filip Skokan*

---

From: Neil Madden <[email-masked]>
Date: Thu, 25 Mar 2021 09:54:37 +0000

ForgeRock plan to implement PAR.

— Neil

> On 24 Mar 2021, at 19:53, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all, 
>  
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________
> OAuth mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

-- 
ForgeRock values your Privacy <https://www.forgerock.com/your-privacy>

---

From: Warren Parad <[email-masked]>
Date: Thu, 25 Mar 2021 11:26:14 +0100

Authress supports PAR.

- Warren

---

From: Daniel Fett <[email-masked]>
Date: Thu, 25 Mar 2021 11:54:49 +0100

Hi Hannes,

as mentioned by Brian, the yes Signing Flow is based on PAR and
therefore implemented by our banks (> 1000).

A python client for the yes signing flow is publicly available that uses
PAR: https://github.com/yescom/pyyes

-Daniel

Am 24.03.21 um 20:53 schrieb Hannes Tschofenig:
> Can you share whether you are implementing, or planning to implement
> this specification? If there is open source, please drop a link to the
> mailing list. If you implement it in your product, please let us know
> as well.  
>
>  
>
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.
>

-- 
https://danielfett.de

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Thu, 25 Mar 2021 12:59:17 +0200

Supported by

  * the Connect2id server

  * the open source OAuth 2.0 / OIDC SDK, and also picked up by some
    downstream security frameworks and projects

    https://connect2id.com/blog/pushed-authorisation-request-in-oauth-sdk

Adoption of PAR seems to be progressing rather well, which I find 
positive and a testament to the PAR simplicity and ingenuity.

Vladimir

---

From: Nicolas Mora <[email-masked]>
Date: Thu, 25 Mar 2021 07:31:18 -0400

Hello,

Le 2021-03-24 à 15 h 53, Hannes Tschofenig a écrit :
> mailing list. If you implement it in your product, please let us know as 
> well.
> 

Glewlwyd 2.5.2 supports PAR:
https://github.com/babelouest/glewlwyd

/Nicolas

---

From: Filip Skokan <[email-masked]>
Date: Thu, 25 Mar 2021 13:46:00 +0100

The Node.js open source openid-client project (
https://github.com/panva/node-openid-client) likewise implements PAR.

Best,
*Filip*

---

From: Takahiko Kawasaki <[email-masked]>
Date: Fri, 26 Mar 2021 02:44:36 +0900

Hello Hannes,

Authlete supports PAR and has passed the PAR test cases in the OpenID
conformance suite.

Documents mentioning Authlete's PAR support:
https://www.authlete.com/news/20210204_authlete_2_2/
https://www.authlete.com/developers/relnotes/2.2/

Best Regards,
Takahiko Kawasaki
Authlete, Inc.

---

From: Thibault Normand <[email-masked]>
Date: Fri, 26 Mar 2021 14:26:37 +0100

Hello,

My Golang open source framework implements PAR (with optional JWSREQ).

https://github.com/zntrio/solid

---
Regards,
Thibault Normand.

Le jeu. 25 mars 2021 à 18:45, Takahiko Kawasaki <[email-masked]> a
écrit :

> On Thu, Mar 25, 2021 at 4:53 AM Hannes Tschofenig <
> [email-masked]> wrote:
>
>> Hi all,
>>
>>
>>