I-D Action: draft-gazitt-oauth-authzen-claims-00.txt

Internet-Draft draft-gazitt-oauth-authzen-claims-00.txt is now available.

   Title:   AuthZEN Profile for Authorization Claims in JWT Access Tokens
   Author:  Omri Gazitt
   Name:    draft-gazitt-oauth-authzen-claims-00.txt
   Pages:   23
   Dates:   2026-08-14

Abstract:

   RFC 9068 recommends that an authorization server placing group
   memberships, roles, or entitlements in a JWT access token draw those
   claims from the SCIM user schema.  It says what the claims are named
   and how their values are encoded, and it does not say where an
   authorization server obtains them.  In deployments today they come
   from a directory, a database, or a vendor-specific hook, and the
   question they answer is an authorization question asked of something
   that is not the authorization system.

   This document profiles the Resource Search API of the OpenID AuthZEN
   Authorization API for that purpose.  It binds each authorization
   claim to a search, defines how a search result set becomes a claim
   value, and requires that a search result never influence whether a
   token is issued or what authority it conveys.  It may be applied on
   its own, by an authorization server that externalizes claim
   enrichment but not its issuance decision, or alongside the companion
   framework document that externalizes the decision.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-gazitt-oauth-authzen-claims/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-gazitt-oauth-authzen-claims-00.html

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]