IETF Transaction Tokens (Txn-Tokens) support

[badbort]

Howdy

Frustrated with existing patterns regarding authz within microservice architectures, I stumbled upon a working group's efforts on the tx-token spec.

At time of posting, the latest spec can be found here: https://datatracker.ietf.org/doc/html/[draft-ietf-oauth-transaction-tokens-11](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-transaction-tokens-11)

See also:

• https://curity.io/blog/transaction-tokens-new-phantom-tokens/
• https://uberether.com/transaction-tokens-identity-chaining-and-stopping-token-theft-in-multi-workload-call-chains/

I'm certainly not fluent in this domain enough to confidently explain it to someone else, so I'll mostly just leave links. I'm loving how context can be propagated across microservice hops, and something I felt missing when working in microservice architectures. Always forced to use custom setups, and confused and frustrated at the variations across ecosystems, particularly when I'm in Entra which has its own opinions.

This spec at first seems like the holy grail of what I was hoping for. The question is the toolchain around it. I certainly don't want to own a complete implementation it from scratch, even if it were possible now using Duende as the core layer. Having native transaction token server support would definitely solidify Duende as an additional issuer within my ecosystem.

I'd love to know if Duende is exploring this proposal, or offers any opinions.

[josephdecock]

Hi @badbort!

This is a great discussion topic. We're definitely interested in transaction tokens, and I've been following the developments of this and related drafts closely. I agree, they seem very useful for propagating context through call chains and are great for microservices and other workloads.

Transaction tokens are really a standardization of a pattern that we see many of our advanced users following: token exchange. At the end of the day, transaction tokens are just rules for how to perform a token exchange, so you can actually implement that on top of IdentityServer's support for token exchange today.

While I'm not making a product announcement today about whether we can or will include more formal support for transaction tokens, we'd love to talk to you. Feel free to join our Discord and ping me - I'm joedecock. Would love to chat and exchange ideas!

[badbort]

Cool cool, thanks for fast response.
I'll message you in discord and explain what I'm trying to achieve and some vague info on my platform setup and challenges.