[OAUTH-WG] Re: [Technical Errata Reported] RFC9470 (7951)

2024-08-05 Thread Brian Campbell
I believe this errata should be verified, if that wasn't clear from my prior message. The errata process remains somewhat opaque to me, however, so I'm not sure what happens next. But I don't think anything is needed from your side at this point. On Mon, Aug 5, 2024 at 4:22 AM Tomasz Kuczyński < t

[OAUTH-WG] Re: [Technical Errata Reported] RFC9470 (7951)

2024-08-05 Thread Tomasz Kuczyński
It took some time since the last message in the thread. Could you please let me know if there is any additional information or action required from my side for the verification process? Or is it simply a matter of waiting for the process to complete? Best regards Tomasz Kuczyński W dniu 30.05

[OAUTH-WG] Re: [Technical Errata Reported] RFC9470 (7951)

2024-05-30 Thread Brian Campbell
I suspect a variety of not-entirely-improbable rational could be provided to explain why it might make sense. But the reality is that it's just a mistake in the document where somewhere along the way updates were made to the examples that didn't fully align with content already in those examples. I

[OAUTH-WG] Re: [Technical Errata Reported] RFC9470 (7951)

2024-05-23 Thread Tomasz Kuczyński
The introspection response should rather reflect facts related to the access token sent for the introspection. So even in case, a new authentication event took place after the token issuance, it should not be included in the response as the authentication event is not related to the introspecte

[OAUTH-WG] Re: [Technical Errata Reported] RFC9470 (7951)

2024-05-22 Thread Justin Richer
This seems to be logical - the authentication event would always be before the token was issued in the usual case. However, assuming that the AS "upgrades" an existing token in-place during a step up, isn't it possible for the latest relevant authentication event to come after the token was init