OAuth Token and TokenAudience interaction

[Cantor, Scott]

It doesn't seem plausible that it can be honoring the TokenAudience if there are multiple audiences since it would still have to combine them somehow but I vaguely recall that it may only enforce things based on the primary/first audience simply because of how unworkable it is to try and pull in everything.

In general, OIDC and OAuth just don't mix well. There are no clear ways of handling the conflicts that arise with them because the former was meant only to support access tokens issued for the OP itself and the attempts to combine them are at best murky.

I would have thought in fact that it would have tried to combine the values and then pick the shortest, actually. That seems like the most plausible way to do it, short of getting into more crazy options to try and control it, which is pretty insanely complex.

In any case, filing a "bug" even though it's not a bug would be the best way of getting it documented and make sure it's behaving as intended. There is no right or wrong answer, because the standards are non-interoperable.

>  Could I, for instance, define an `accessTokenLifetimeLookupStrategy` in the
> TokenAudience bean that returns a value based on the id of the *client*
> that initiated the authentication?

Yes, the PRC is the input because that grants carte blanche access to the entire request state. The context tree for a token request involving audiences though is not really documented, and quite complex.

-- Scott