[JIRA] (JOIDC-7) Support JWT access tokens for authorization_code or implicit grants

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-7 ( https://shibboleth.atlassian.net/browse/JOIDC-7?atlOrigin=eyJpIjoiMDc5ZTBiNDZiODMzNDZlMjkyMzVjYTBiMzNhN2ZmY2QiLCJwIjoiaiJ9 )

Re: Support JWT access tokens for authorization_code or implicit grants ( https://shibboleth.atlassian.net/browse/JOIDC-7?atlOrigin=eyJpIjoiMDc5ZTBiNDZiODMzNDZlMjkyMzVjYTBiMzNhN2ZmY2QiLCJwIjoiaiJ9 )

The dev branch now also contains enhancements to the authorize flow so this is all nominally done for all grants, except for the TBD around sealing the special claims.

I’ve done real RP testing with the token endpoint changes and unit testing of the authorize endpoint.

Implementation is done consistent with the client_credentials grant’s handling of the resource parameter and controlling behavior via the OAUTH2.TokenAudience profile bean.

Encryption of the access token is disallowed at present if the openid scope is present, which is always true on the authorize endpoint but not a given on the token endpoint.

Once the authorize endpoint is fixed to handle non-OpenID requests, we should more or less have the 4 legged OAuth case handled.

( https://shibboleth.atlassian.net/browse/JOIDC-7#add-comment?atlOrigin=eyJpIjoiMDc5ZTBiNDZiODMzNDZlMjkyMzVjYTBiMzNhN2ZmY2QiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-7#add-comment?atlOrigin=eyJpIjoiMDc5ZTBiNDZiODMzNDZlMjkyMzVjYTBiMzNhN2ZmY2QiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220426/90c2d1da/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c5270e41-7341-49a5-9d98-c582e1a5cdfb
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220426/90c2d1da/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-dbdb7991-c5f5-41b9-a526-b13676a7ea86
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220426/90c2d1da/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-68fe2563-221c-495d-b25b-a20024a0f0ec
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220426/90c2d1da/attachment-0005.png>