---
# System prepended metadata

title: Meeting on 2024-01-26

---

# Meeting on 2024-01-26

## Attendees
* Atul Tulshibagwale (SGNL)
* Rifaat Shekh-Yusef (EY)
* Brian Campbell (Ping)
* Arndt Schwenkschuster (Microsoft)
* Naveen CM (Yahoo)
* Mike Jenkins (NSA)
* Pieter Kasselman (Microsoft)

## Agenda

### Need for this meeting


### How long should be the TraTs lifetime
* (Atul) I've seen similar tokens have about 5 minutes lifetime
* (Naveen) We initially went with 2 minutes, but some teams want to reuse tokens for up to 5 minutes
* (Atul) How long does it take to reissue the token?
* (Naveen) It is based on public-private keys, so takes a few milliseconds to reissue, hence the need to reuse
* (Arndt) I would look into self-issuing the tokens in the API gateway to reduce network latency
* (Naveen) We wanted to keep it in one system to prevent possibility of compromise
* (Atul) Is the few milliseconds latency that significant in a transaction that lasts > 5 minutes
* (Naveen) I just wanted to know the general guideline
* (Arndt) This is going to be a primary use case of TraTs, people would have a gateway that swaps the access token for a TraT


### [Header PR](https://github.com/oauth-wg/oauth-transaction-tokens/pull/64)
* (Brian) The last sentence is inaccurate, so it will be ignored or cause incompatibilities / people rejecting valid JWTs. I'd suggest not having that last sentence, or make it accurate
* (Atul) I will remove the sentence that is problematic, because the JWT format is always the same.
* (Brian) The HTTP reference is way out of date. Needs to be updated
* (Brian) If you are standardizing a HTTP header, you need to request registration, which may be a larger effort. I have done a "client certificate" field value, which is standardized in RFC9440, which is similar to this, so we can take a similar approach
* (Arndt) Is there a header that we can reuse?
* (Arndt) Are we talking about the IANA registration?
* (Brian) Yes
* (Arndt) Here are two links on how to go about the registration: [HTTP Fields](https://www.iana.org/assignments/http-fields/http-fields.xhtml) and [2](https://github.com/protocol-registries/http-fields)
* (Arndt) Should we plan for having only one value or multiple values. Any transaction that involves two principals may require two transaction tokens
* (Brian) One of the criteria for requesting a header, is to specify whether it can occur multiple times, or have multiple values
* (Brian) A single instance and single value is preferable at this time
* (Rifaat) Is there an existing header that we can use?
* (Arndt) I didn't see an existing header that could be appropriate. I searched for "token", or "transaction" and did not find anything useful
* (Rifaat) We should do comprehensive due diligence before we propose a new header
* (Arndt) As a part of the registration, we can ask the maintainers of the registry whether there is something we can reuse


### Identity Chaining Name Change
* I am going to send an email to the editors to get approval to include them as proponents of the change

### Wimse charter
* The [Wimse charter](https://notes.ietf.org/Eg7vhJqUT_eyPI9LfJ9SXg?view) has solidified and is probably going to go to ISG for approval, so please review
* (Atul) The TraT draft was talked about as one that can move from OAuth to Wimse, when is that discussion likely to take place?
* (Pieter, Rifaat) Let's see if Wimse group gets formed, and then we can discuss this

### Aaron's Draft
* (Pieter) I've invited Aaron to the next week's meeting
* (Pieter) The draft is about taking id-chaining and putting more specific details about claims and scopes for specific applications (e.g. SaaS deployments)
* (Pieter) Aaron can provide details next week



