OAuth SPIFFE Client Authentication（OAuth/OIDC Numa (Immersion) Workshop 2026）

2026/08/25 開催
OAuth/OIDC Numa (Immersion) Workshop 2026 発表資料

OAuth SPIFFE Client Authentication

株式会社Authlete
川崎 貴彦

Transcript

1. OAuth/OIDC Numa Workshop 2026 OAuth SPIFFE Client Authentication August 25, 2026
2. Speaker Co-founder of Authlete, Inc. Software Engineer. After graduating from Keio University’s Faculty of Policy Management in 1997, he worked at four private companies before becoming independent in 2009. He has been involved in network and database systems, Java Virtual Machine, mobile applications, and distributed systems. Takahiko Kawasaki He devised a unique architecture that modularizes and provides OAuth 2.0 / OpenID Connect implementations as SaaS — global standard technologies for Web API security and Identity Federation. In 2015, he founded Authlete, Inc. Currently, he participates in global standardization efforts and translates them into commercial implementations. Tech blog in English: https://darutk.medium.com Tech blog in Japanese: https://qiita.com/TakahikoKawasaki
3. SPIFFE Verifiable Identity Document (SVID) (1/2) SPIFFE Server issue Workload X.509 Certificate X.509 SVID Workload access Cert verify including the identifier of the workload SPIFFE ID issue JWT JWT SVID Public Keys for Signature Verification Workload access JWT verify including the identifier of the workload SPIFFE ID publish Verification Keys
4. SPIFFE Verifiable Identity Document (SVID) (2/2) SVID X.509 SVID JWT SVID WIT SVID JWT SVID Header Parameter alg REQUIRED kid OPTIONAL typ OPTIONAL. JWT or JOSE. JWT SVID Payload Claim sub REQUIRED. A SPIFFE ID. aud REQUIRED exp REQUIRED SPIFFE ID Format spiffe://trust-domain-name/path
5. OAuth SPIFFE Client Authentication Method Summary spiffe_x509 Mutual TLS: Client Certificate = X.509 SVID (Subject Alternative Name URI = SPIFFE ID) spiffe_jwt Form Parameters: client_assertion_type = urn:ietf:params:oauth:client-assertion-type:jwt-spiffe client_assertion = JWT SVID (sub = SPIFFE ID) spiffe_wit HTTP Header Fields: OAuth-Client-Attestation = WIT SVID (sub = SPIFFE ID) OAuth-Client-Attestation-PoP = Proof of Possession (JWT) The current spiffe_wit specification extends the OAuth 2.0 Attestation-Based Client Authentication specification in a breaking way, so I propose using the Workload-Identity-Token header (defined in the WIMSE Workload Credentials specification) and introducing a new Workload-Identity-Token-PoP header instread. See Issue 39 for details: https://github.com/oauth-wg/oauth-spiffe-client-authentication/issues/39
6. Client https://as.example.com Token Request Authorization Server ... &client_id=https%3A%2F%2Fexample.com%2Fclient.json &client_assertion_type=urn%3Aietf%3Aparams%3Aoauth %3Aclient-assertion-type%3Ajwt-spiffe &client_assertion= JWT SVID client_id= https://example.com/client.json /token { { JWT SVID Payload /client.json Client ID Metadata Document "client_id": "https://example.com/client.json", "spiffe_id": "spiffe://example.org/client", "spiffe_bundle_endpoint": "https://example.org/bundle", "token_endpoint_auth_method": "spiffe_jwt", ... "aud": "https://as.example.com", "sub": "spiffe://example.org/client", "exp": 1747124543, "iat": 1747124243 } JWT SVID Signature https://example.com https://example.org /bundle } Verify { OAuth SPIFFE Client Authentication using JWT SVID (spiffe_jwt) + Client ID Metadata Document (CIMD) SPIFFE Bundle "keys": [ { "use": "jwt-svid", ... } Verification Key ], "spiffe_sequence": 10, "spiffe_refresh_hint": 300 } The last path segment of the spiffe_id client metadata value may be a wildcard. The spiffe_bundle_endpoint client metadata indicates the location where the SPIFFE Bundle is published. © 2026 Authlete, Inc.
7. Trust Domain 1 Trust Domain 2 client https://as.trustdomain2 (authorization server) Token Request ... &client_id=https%3A%2F%2Frp.trustdomain1%2Fclient1 &client_assertion_type=urn%3Aietf%3Aparams%3Aoauth %3Aclient-assertion-type%3Ajwt-spiffe &client_assertion= SPIFFE JWT-SVID SPIFFE JWT-SVID Header { "aud": "https://as.trustdomain2", "sub": "spiffe://trustdomain1/client1", "exp": 1747124543 } Trust Chain entity configuration /client1/.well-known/openid-federation https://ia.trustdomain1 (intermediate authority) /.well-known/openid-federation entity configuration /fetch ?sub=https%3A%2F%2Frp.trustdomain1%2Fclient1 https://sp.trustdomain1 (SPIFFE server) { /bundle Access Token ID Token /.well-known/openid-federation /fetch ?sub=https%3A%2F%2Fia.trustdomain1 entity statement { 3. The authorization server extract the client metadata from the trust chain. Optionally, intermediate authorities and the trust anchor can enforce client metadata policies. https://trustanchor (trust anchor) entity statement entity configuration Demo Videos: [English] https://youtu.be/EvOSyqAAAq0 [Japanese] https://youtu.be/9UHo-vvBAHM 1. The client application sends a token request to the authorization server using its SPIFFE JWTSVID as the client assertion in OAuth SPIFFE Client Authentication. 2. Based on the client ID in the token request, the authorization server constructs a trust chain. This OpenID Federation mechanism establishes a trust relationship between entities in different networks. SPIFFE JWT-SVID Signature https://rp.trustdomain1 (leaf entity for relying party) OpenID Federation + SPIFFE Client Authentication Client Metadata "client_id": "https://rp.trustdomain1/client1", "spiffe_id": "spiffe://trustdmain1/client1", "spiffe_bundle_endpoint": "https://sp.trustdomain1/bundle", 4. The authorization server confirms that the SPIFFE ID in the SPIFFE JWT-SVID matches the spiffe_id client metadata. 5. The authorization server fetches the SPIFFE Bundle from the endpoint indicated by the spiffe_bundle_endpoint client metadata. 6. The authorization server verifies the signature of the SPIFFE JWT-SVID using the verification key in the SPIFFE Bundle. SPIFFE Bundle "keys": [ { "use": "jwt-svid", ... }, Verification Key verify 7. The authorization server then issues an access token and, optionally, an ID token. © 2026 Authlete, Inc.
8. Q&A