We've just published draft -06 of the Identity Assertion JWT Authorization Grant (ID-JAG):
https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
It's been great to see so many new implementations of ID-JAG over the past few months, across identity providers, authorization servers, clients and libraries. -05 and -06 are mostly about bringing what we've learned from these implementations back into the spec. The diff looks big, but most of it tightens the wording so independent implementations interoperate better. The flow and the overall design haven't changed.
Most of the changes are clarifications, such as:
- How resource and audience values are compared and validated
- Which sub value the IdP selects for the Resource Authorization Server, and how subject identifiers are mapped
- Whose claims the ID-JAG carries (End-User, client, etc)
- How the Resource Authorization Server finds and validates the ID-JAG signing keys
- SAML
NameIDhandling - Using a Refresh Token as the subject token
- Error codes for common failure cases, and when a Client should request a new ID-JAG
- Fixes to examples and references
A few changes are new, or make explicit what implementations were already doing:
- The IdP authenticates the Client at the Token Exchange step, and the request carries a single audience value
- When a subject token fails validation, the IdP now returns
invalid_requestinstead ofinvalid_grant, as RFC 8693 requires. If you've implemented the Token Exchange step, please check your error handling. - At the Resource Authorization Server, a key-bound ID-JAG can be used in place of client authentication
- mTLS is defined as another option besides DPoP for binding the ID-JAG
- New
id_jag_signing_alg_values_supportedIdP metadata - A new Privacy Considerations section
The full list is in the Document History section.
Thanks to everyone who has been implementing this and sending feedback, and especially to Karl for working through so many of the issues. I'm hoping to get time at IETF 127 to go over the remaining open issues. In the meantime, comments are welcome on the list or at https://github.com/oauth-wg/oauth-identity-assertion-authz-grant
