Make PoP optional - Githubissues

oauth-wg / draft-ietf-oauth-attestation-based-client-auth

Other

10 stars 7 forks source link

Make PoP optional #75

Closed nikosft closed 3 months ago

nikosft commented 5 months ago

I believe there are many existing systems that generate "client attestations" and can benefit from this draft, examples of such client attestations are:

Github's oidc token for actions
SPRIFFE JWT Verifiable Document
Azure AD Pod identity

However in all these solutions, attestations are not bound to any key.

tplooker commented 4 months ago

OpenID and OAuth already have mechanisms for ordinarily signed JWTs as a means of client authentication toward an AS, such as private key jwt and token exchange so I'm unsure how supporting this would be any different to those existing mechanisms?

nikosft commented 3 months ago

Yes you are right