Support Identity Assertion JWT Authorization Grant (ID-JAG)

[Akankshabhasin]

Description

The Identity Assertion JWT Authorization Grant (ID-JAG) is an emerging OAuth draft that enables an application to obtain an access token for a third-party API through a common enterprise identity provider.

It builds on RFC 8693 (OAuth 2.0 Token Exchange) and RFC 7523 (JWT Bearer Grant)

The flow works in two steps:

1. A client exchanges an ID Token for an ID-JAG at the identity provider.
2. The client presents the ID-JAG to a resource authorization server using the JWT Bearer grant to obtain an access token.

Why this matters

This enables enterprise cross-application API access, allowing identity providers to mediate authorization between services while preserving the original user identity.

References

• IETF Draft: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
• Related discussion: Identity Assertion JWT Authorization Grant keycloak/keycloak#43971