Skip to content

OAuth Identity and Authorization Chaining Across Domains + Transaction Tokens — draft-ietf-oauth-identity-chaining, draft-ietf-oauth-transaction-tokens#

IETF 123 (Madrid) digest Program Core pick Madrid · 19–25 July 2025

Draft Slides Session recording Materials

  • Tier: Core
  • Why: These two are the agentic/multi-hop authorization story. As calls fan out across services and trust-domain boundaries, you need to carry who originated this and what they're allowed to do without re-minting broad bearer tokens at every hop. This is directly the workload-and-agentic-identity space you track.
  • What: identity-chaining preserves identity and authorization across OAuth trust domains by chaining context through JWT authorization grants obtained via Token Exchange (RFC 8693) and JWT Bearer (RFC 7523). transaction-tokens (Txn-Tokens) carry user identity, workload identity, and authorization context through an entire internal call chain within a trust domain for a given external request. (from abstract only)
  • How: Identity-chaining repeats the same Token-Exchange-based protocol each time a domain boundary is crossed, so the chain composes across multiple domains. Transaction Tokens scope context to a single inbound request and propagate it internally, so downstream services act with the originator's narrow context rather than a reusable broad token.
  • Where applicable: General OAuth deployments with microservice call chains; especially relevant where requests cross organizational/trust boundaries (B2B, federated enterprise SSO).