[JIRA] (JOIDC-7) Support JWT access tokens for authorization_code or implicit grants

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-7 ( https://shibboleth.atlassian.net/browse/JOIDC-7?atlOrigin=eyJpIjoiMTA0NDQ4NDY0NzNjNGM4NjhmNDM2MzQ4NmRhMjRkNTUiLCJwIjoiaiJ9 )

Re: Support JWT access tokens for authorization_code or implicit grants ( https://shibboleth.atlassian.net/browse/JOIDC-7?atlOrigin=eyJpIjoiMTA0NDQ4NDY0NzNjNGM4NjhmNDM2MzQ4NmRhMjRkNTUiLCJwIjoiaiJ9 )

Some POC work on dev branch. Something possibly close checked in that isn’t breaking tests too much, tried to rework the token flow around whether the access token is being issued for use with the OP only or if there’s an external resource server (which handles the original client_credentials case).

ID token steps moved to a separate conditional step that runs only with openid scope in play but this needs more study, as I assume the original code must have been tighter around e.g. not issuing it during a refresh grant but I didn’t notice that logic in place either. Probably just needs to be extended to check for both the scope and the code grant type.

Big TBD is handling the special operational claims that get embedded in the access token, which need to be separately sealed to protect them when a JWT is used, to hide them from the client and resource.

( https://shibboleth.atlassian.net/browse/JOIDC-7#add-comment?atlOrigin=eyJpIjoiMTA0NDQ4NDY0NzNjNGM4NjhmNDM2MzQ4NmRhMjRkNTUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-7#add-comment?atlOrigin=eyJpIjoiMTA0NDQ4NDY0NzNjNGM4NjhmNDM2MzQ4NmRhMjRkNTUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220414/bbe0ec94/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f090e20d-ca88-4ba4-bc9c-7d3e881fe6a4
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220414/bbe0ec94/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ab174c42-8abe-4630-8687-d00ad3f2a86a
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220414/bbe0ec94/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-6a08f3e2-1535-447d-b5bc-685973f7f873
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220414/bbe0ec94/attachment-0005.png>