Problem description
Best Current Practice for OAuth 2.0 Security was finally published by IETF as RFC9700.
We should analyze the new RFC9700 and evaluate whether we should change our security recommendations in CAMARA Security and Interoperability Profile.
Possible evolution
e.g. change this recommendation "CAMARA Authorization Servers SHOULD implement PKCE" to a requirement "CAMARA Authorization Servers MUST implement PKCE"
e.g. change the section on sender contraint tokens again mandating that CAMARA authorization server MUST support DPoP.
RFC9700 recommends that the Authorization Server provide a way to detect feature support.
Authorization servers MUST provide a way to detect their support for PKCE. It is RECOMMENDED for authorization servers to publish the element code_challenge_methods_supported in their Authorization Server Metadata [RFC8414] containing the supported PKCE challenge methods (which can be used by the client to detect PKCE support). Authorization servers MAY instead provide a deployment-specific way to ensure or determine PKCE support by the authorization server.
Should CAMARA recommend publishing meta-data, or demand publishing meta-data, or ...
Should ICM provide a template meta-data file? Maybe that is a separate issue...
Alternative solution
Do nothing because the profile is good enough and Authorization Servers do not need this extra work for higher security.
Additional context
Problem description
Best Current Practice for OAuth 2.0 Security was finally published by IETF as RFC9700.
We should analyze the new RFC9700 and evaluate whether we should change our security recommendations in CAMARA Security and Interoperability Profile.
Possible evolution
e.g. change this recommendation "CAMARA Authorization Servers SHOULD implement PKCE" to a requirement "CAMARA Authorization Servers MUST implement PKCE"
e.g. change the section on sender contraint tokens again mandating that CAMARA authorization server MUST support DPoP.
RFC9700 recommends that the Authorization Server provide a way to detect feature support.
Should CAMARA recommend publishing meta-data, or demand publishing meta-data, or ...
Should ICM provide a template meta-data file? Maybe that is a separate issue...
Alternative solution
Do nothing because the profile is good enough and Authorization Servers do not need this extra work for higher security.
Additional context