Skip to content

OAuth Cross-Domain Identity Chaining & Transaction Tokens — draft-ietf-oauth-identity-chaining, draft-ietf-oauth-transaction-tokens#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

Draft Slides Session recording Materials

  • Tier: Core
  • Why: This is the multi-hop authorization story for agentic and microservice call chains — how you carry who originated this and what they're allowed to do across service and trust-domain boundaries without re-minting broad bearer tokens at every hop.
  • What: identity-chaining preserves identity and authorization context across OAuth trust domains by chaining JWT authorization grants obtained via Token Exchange (RFC 8693) each time a domain boundary is crossed. transaction-tokens (Txn-Tokens) propagate user identity, workload identity, and authorization context through an entire internal call chain within one trust domain for a given external request. (from abstract only)
  • How: Identity-chaining repeats the same Token-Exchange protocol at each domain hop so the chain composes across multiple domains; Transaction Tokens scope context tightly to a single inbound request and propagate it internally so downstream services act with the originator's narrow context.
  • Where applicable: Microservice architectures with OAuth in place; identity-chaining specifically targets requests crossing organizational or trust-domain boundaries (B2B, federated enterprise SSO).