Subject: [Txauth] XYZ vs XAuth: OAuth 2.0 / OIDC compatibility

From: Dick Hardt <[email-masked]>
Date: Mon, 16 Mar 2020 16:04:39 -0700

*OAuth 2.0 / OIDC compatibility*
XYZ
- use key handles to identify Client, or uses public key presented by value
(no explicit difference between dynamic and static clients in the protocol)
- support for subject, email, phone, ID Token claims
- rich resource request, supports OAuth/OIDC style scopes in the same
structure through resource handles
- access token refresh is done with transaction handle to transaction
endpoint (transaction / grant oriented, similar to refresh token)
- support for OIDC UserInfo Endpoint through access token for additional
claims

XYZ Rationale: clean take on existing concepts, allowing us to map things
that work well without forcing things that don’t work well into us; if you
have a static client ID and set of scopes, those all have places to fit; if
your case doesn’t fit that, you don’t have to force it. No need for dynamic
registration step.

XAuth
- uses Client ID to identify registered Clients, just as it was used in
OAuth 2.0 / OIDC
- Dynamic Clients are identified by public key value (same as XYZ)
- directly reuses OAuth scopes
- allows rich resource requests from RAR
- support for all OIDC Claims in an ID Token, or separately
- uses a per-access-token refresh token and URL (token / authorization
oriented)

XAuth Rationale: minimize migration friction for existing deployments.
Enable multiple schemas for expressing resources and claims to simplify
adoption of existing schemas and creation of new schemas.
ᐧ