diff --git a/draft-ietf-wimse-workload-identity-bcp.md b/draft-ietf-wimse-workload-identity-bcp.md index 0003711..574e148 100644 --- a/draft-ietf-wimse-workload-identity-bcp.md +++ b/draft-ietf-wimse-workload-identity-bcp.md @@ -85,7 +85,7 @@ informative: --- abstract -The use of the OAuth 2.0 framework for container orchestration systems poses a challenge as managing secrets, such as client_id and client_secret, can be complex and error-prone. Instead of manual provisioning these credentials the industry has moved to a federation-based approach where credentials of the underlying workload platform are used as assertions towards an OAuth authorization server leveraging the Client Assertion Flow {{RFC7521}}, in particular {{RFC7523}}. +The use of the OAuth 2.0 framework in container orchestration systems poses challenges, particularly in managing credentials such as client_id and client_secret, which can be complex and prone to errors. To address this, the industry has shifted towards a federation-based approach where credentials of the underlying workload platform are used as assertions towards an OAuth authorization server, leveraging the Assertion Framework for OAuth 2.0 Client Authentication {{RFC7521}}, specifically {{RFC7523}}. This specification describes a meta flow in {{overview}}, gives security recommendations in {{recommendations}} and outlines concrete patterns in {{patterns}}.