Subject: [OAUTH-WG] OAuth 2.0 Rich Authorization Requests (RAR): Implementation Status

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 6 Apr 2022 13:46:15 +0000

Hi all,

I am working on the shepherd writeup for the RAR document and the IESG is interested to hear about the implementation status of this specification.

What implementations are available that use the RAR functionality or are vendors planning to implement this specification?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 6 Apr 2022 16:54:47 +0200

Hi, 

the yes ecosystem (1200 IDPs) uses RAR for authorising payment initiation and qualified electronic signatures. 

The Cloud Signature Consortium included RAR as means to authorise electronic signature to the v 2.0 of its API for remote signature creation (https://cloudsignatureconsortium.org/resources/ <https://cloudsignatureconsortium.org/resources/>). 

OpenID Foundation’s FAPI working group added RAR support to the FAPI 2 baseline profile (https://openid.net/specs/fapi-2_0-baseline-01.html <https://openid.net/specs/fapi-2_0-baseline-01.html>).

best regards,
Torsten. 

> Am 06.04.2022 um 15:46 schrieb Hannes Tschofenig <[email-masked]>:
> 
> Hi all, 
>  
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________
> OAuth mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: Takahiko Kawasaki <[email-masked]>
Date: Thu, 7 Apr 2022 01:04:19 +0900

Dear Hannes,

For the writeup:
Authlete supports RAR since version 2.2 and it is confirmed that at least
one of their customers is operating a commercial service that utilizes RAR
with CIBA as of April, 2022.

Best Regards,
Takahiko Kawasaki

On Wed, Apr 6, 2022 at 10:46 PM Hannes Tschofenig <[email-masked]>
wrote:

> Hi all,
>
>
>
> I am working on the shepherd writeup for the RAR document and the IESG is
> interested to hear about the implementation status of this specification.
>
>
>
> What implementations are available that use the RAR functionality or are
> vendors planning to implement this specification?
>
>
>
> Ciao
>
> Hannes
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Thu, 7 Apr 2022 16:07:27 +0300

Hello Hannes,

The RAR spec has been stable for some time now and received production 
implementations in several different industries.

https://connect2id.com/products/server/docs/datasheet#rar

~Vladimir

--
Vladimir Dzhuvinov

On 06/04/2022 16:46, Hannes Tschofenig wrote:
>
> Hi all,
>
> I am working on the shepherd writeup for the RAR document and the IESG 
> is interested to hear about the implementation status of this 
> specification.
>
> What implementations are available that use the RAR functionality or 
> are vendors planning to implement this specification?
>
> Ciao
>
> Hannes
>

---

From: Nicolas Mora <[email-masked]>
Date: Sun, 10 Apr 2022 21:12:14 -0400

Hello Hannes,

Glewlwyd supports rich auth requests, but in a 'generic' way, not to 
support an existing implementation.

https://babelouest.io/glewlwyd/

/Nicolas

Le 2022-04-06 à 09 h 46, Hannes Tschofenig a écrit :
> is interested to hear about the implementation status of this specification.
> 
> contents to any other person, use it for any purpose, or store or copy 
> the information in any medium. Thank you.
>