I-D Action: draft-zhu-oauth-async-delegation-04.txt

Internet-Draft draft-zhu-oauth-async-delegation-04.txt is now available.

   Title:   Delegated Refresh Tokens for OAuth 2.0 Token Exchange
   Authors: Larry Zhu
            Zate Berg
   Name:    draft-zhu-oauth-async-delegation-04.txt
   Pages:   22
   Dates:   2026-07-23

Abstract:

   OAuth 2.0 Token Exchange permits an authorization server to issue a
   refresh token when a client needs continued access after the original
   credential is no longer valid.  However, RFC 8693 does not define how
   a refresh token issued by a delegated Token Exchange preserves the
   subject, actor chain, resource restrictions, or other delegated
   authorization state.

   This specification profiles refresh tokens issued by delegated OAuth
   2.0 Token Exchange for asynchronous and long-running workflows.  It
   defines authorization-server metadata advertising profile support and
   a Token Exchange request signal by which a client requests delegated
   continuation, together with preservation of subject and actor
   relationships, client and actor binding, resource confinement, scope
   monotonicity, authorization re-evaluation, rotation, task-scoped
   revocation, and a bounded delegation lifetime.  The common discovery
   signal, request signal, and semantics enable autonomous agents and
   other product components to interoperate with independently
   implemented authorization servers across trust domains.

   Because a client generally cannot determine the effective lifetime of
   an opaque refresh token, this profile requires the client to request
   continuation only for an identified asynchronous task and to promptly
   revoke the refresh-token family when that task reaches a terminal
   state.  These requirements reduce unnecessary issuance and limit the
   period in which residual delegated authority can be abused.  The
   profile uses the existing OAuth refresh token response and grant and
   introduces no new token type or grant type.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-zhu-oauth-async-delegation/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-zhu-oauth-async-delegation-04.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-zhu-oauth-async-delegation-04

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]