OAuth SPIFFE Client Authentication#

Stian Thorgersen, Scott Rose, Pieter Kasselman, Arndt Schwenkschuster

• Why: This is the concrete SPIFFE↔OAuth bridge — exactly the workload-identity-meets-authorization intersection the PM owns. Workloads acting as OAuth clients today carry static client secrets in config files (the slides show Spring and JSON examples); this replaces them with automatically rotated SVIDs.
• What: WG-adopted draft (draft-ietf-oauth-spiffe-client-auth) profiling RFC 7521/7523 so JWT-SVIDs serve as OAuth client-assertion credentials, X.509-SVIDs ride RFC 8705 mTLS client auth, and — new since IETF 124 — WIT-SVIDs (WIMSE workload identity tokens) fit the attestation-based client-auth draft, with key possession where applicable. New token_endpoint_auth_methods_supported values: spiffe_jwt, spiffe_x509, spiffe_wit.
• How: The AS fetches SPIFFE trust bundles via the SPIFFE Bundle Endpoint (JWKS, RFC 7517) for SVID validation; trust establishment and client registration are prerequisites (enterprise environments typically require registration anyway). Works for 2-legged (client credentials) and 3-legged (auth code + PKCE) flows.
• Where applicable: Any environment running SPIFFE/SPIRE or managed workload identity (Entra Workload ID, Google Managed Workload Identity; deployed at Uber, Netflix, ByteDance, etc.). Keycloak 26.4 ships a preview implementation; an MCP-OAuth client-auth demo exists. The strongest "adopt and implement soon" signal in the identity set.