Skip to content

Commit

Permalink
Editorial clarifications (#115)
Browse files Browse the repository at this point in the history
* Editorial clarifications

Attempt at addressing issue #107

* Corrected Typo
  • Loading branch information
PieterKas authored Jan 10, 2025
1 parent 9f85675 commit 213c333
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions draft-ietf-oauth-identity-chaining.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ A client in trust domain A that needs to access a resource server in trust domai

## Overview

The identity and authorization chaining flow outlined below describes how a combination of OAuth 2.0 Token Exchange {{RFC8693}} and JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants {{RFC7523}} are used to address the use cases identified. The appendix include two additional examples that describe how this flow is used. In one example, the resource server acts as the client and in the other, the authorization server acts as the client.
The identity and authorization chaining flow outlined below describes how a combination of OAuth 2.0 Token Exchange {{RFC8693}} and JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants {{RFC7523}} are used to address the use cases identified. The (Appendix, (#Examples)) include two additional examples that describe how this flow is used when the resource server acts as the client or the authorization server acts as the client.

~~~~
+-------------+ +-------------+ +---------+
Expand Down Expand Up @@ -300,7 +300,7 @@ A user that authenticated to an enterprise Identity Provider (IdP) does not have
## Cross-domain API authorization
An e-mail client can be used with arbitrary email servers, without requiring pre-established relationships between each email client and each email server. An e-mail client obtains an identity assertion (ID Token or SAML token) from an IdP. When the e-mail client needs access to a separate API, such as a third-party calendaring application, the email client exchanges the identity assertion for an authorization grant and uses this authorization grant to obtain an access token for the third-party calendaring application from the authorization server trusted by the third-party calendaring application. If the authorization server trusts the issuer of the authorization grant, the e-mail client obtains an access token without any additional user interaction.

# Examples
# Examples {#Examples}

This section contains two examples, demonstrating how this specification may be used in different environments with specific requirements. The first example shows the resource server acting as the client and the second example shows the authorization server acting as the client.

Expand Down

0 comments on commit 213c333

Please sign in to comment.