Subject: [OAUTH-WG] OAuth JWT Bearer Token Profile

From: Mike Jones <[email-masked]>
Date: Wed, 16 Mar 2011 17:57:20 +0000

I've just published an OAuth JWT Bearer Token Profile<http://self-issued.info/docs/draft-jones-oauth-jwt-bearer.html>.  It defines a means of using a JSON Web Token (JWT) bearer token to request an OAuth 2.0 access token.  This profile is intentionally strongly based upon the SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 2.0<http://www.ietf.org/id/draft-ietf-oauth-saml2-bearer-03.txt> by Brian Campbell and Chuck Mortimore; it borrows some text from the SAML profile with their permission.  Thanks Brian and Chuck, for supporting the writing of this profile and for your reviews of preliminary drafts.

The profile draft is available at these locations:

http://self-issued.info/docs/draft-jones-oauth-jwt-bearer-00.html
http://self-issued.info/docs/draft-jones-oauth-jwt-bearer-00.txt
http://self-issued.info/docs/draft-jones-oauth-jwt-bearer-00.xml
http://self-issued.info/docs/draft-jones-oauth-jwt-bearer.html (will point to new versions as they are posted)
http://self-issued.info/docs/draft-jones-oauth-jwt-bearer.txt (will point to new versions as they are posted)
http://self-issued.info/docs/draft-jones-oauth-jwt-bearer.xml (will point to new versions as they are posted)
http://svn.openid.net/repos/specifications/oauth/2.0/ (Subversion repository, with html, txt, and html versions available)

I will also submit this as a formal Internet draft after the IETF tool re-opens for submissions (on March 28th).

                                                                -- Mike

---

From: Chuck Mortimore <[email-masked]>
Date: Thu, 17 Mar 2011 11:03:10 -0700

Good stuff Mike

Having an explicit error message for "unsupported_alg" might be useful for this spec.  I doubt all implementations will implement all the algs in the JWT spec.

-cmort

On 3/16/11 9:57 AM, "Mike Jones" <[email-masked]> wrote:

I've just published an OAuth JWT Bearer Token Profile <http://self-issued.info/docs/draft-jones-oauth-jwt-bearer.html> .  It defines a means of using a JSON Web Token (JWT) bearer token to request an OAuth 2.0 access token.  This profile is intentionally strongly based upon the SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 2.0 <http://www.ietf.org/id/draft-ietf-oauth-saml2-bearer-03.txt>  by Brian Campbell and Chuck Mortimore; it borrows some text from the SAML profile with their permission.  Thanks Brian and Chuck, for supporting the writing of this profile and for your reviews of preliminary drafts.

                                                                -- Mike

---

From: Mike Jones <[email-masked]>
Date: Mon, 28 Mar 2011 09:33:13 +0000

This is now published as an IETF draft.  The IETF .txt version link is:
              http://www.ietf.org/id/draft-jones-oauth-jwt-bearer-00.txt

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Wednesday, March 16, 2011 10:57 AM
To: [email-masked]
Subject: [OAUTH-WG] OAuth JWT Bearer Token Profile

                                                                -- Mike