Hannes Tschofenig
- Co-chaired the IETF OAuth working group
- Co-chaired ACE, authentication and authorization for constrained environments
- Contributor to more than 90 RFCs on security and internet protocols
Bio
Hannes Tschofenig has co-chaired the IETF OAuth working group and the ACE working group on authentication and authorization for constrained environments, alongside SCITT, KEYPROV, DIME, and ECRIT, and has contributed to more than 90 RFCs. His employers have included Siemens, Nokia, and the European Data Protection Supervisor.
Profile built from public IETF records.
Where their work shows up
Chairing is invisible work that determines what ships: which drafts advance, which objections are load-bearing, and when a working group stops arguing. The OAuth working group produced OAuth 2.0 and the extension stack around it under that kind of stewardship. The ACE work matters separately, because a sensor with kilobytes of RAM cannot run the same authorization flows a browser can, and machine identity at device scale depends on profiles that fit. See the machine identity guides.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b