smolnar82 commented on code in PR #1410: URL: https://github.com/apache/knox/pull/1410#discussion_r4043992081
########## knox-site/docs/knoxidf/endpoints.md: ########## @@ -208,6 +209,47 @@ plus any allowed profile claims (`preferred_username`, `email`, `email_verified` mismatch, PKCE failure, bad `client_secret`, disabled/expired refresh token) or `invalid_request` (unsupported `grant_type`). +### Token Exchange grant + +Trades one JWT for another under [RFC 8693](https://www.rfc-editor.org/rfc/rfc8693) — either for +the same subject (e.g. to narrow a token's audience) or, when delegation is enabled, for a +different subject on whose behalf a trusted actor acts. The concepts, switches, and delegation-policy +model are covered on the [Token Exchange & Delegation](token_exchange.md) page; this section is the +wire-level reference. + +| Parameter | Required | Description | +|-----------|----------|-------------| +| `grant_type` | Yes | `urn:ietf:params:oauth:grant-type:token-exchange`. | +| `subject_token` | Yes | The token whose subject the exchange is for. | +| `subject_token_type` | Yes | `urn:ietf:params:oauth:token-type:jwt` or its alias `urn:ietf:params:oauth:token-type:access_token`; any other type → `invalid_request`. | +| `actor_token` | No | Token of the acting party in an on-behalf-of exchange. | +| `actor_token_type` | Conditional | Required when `actor_token` is present, and must be absent otherwise. Same JWT-family types. | +| `requested_subject` | No | Subject to impersonate in a headless exchange. Read only when `delegation.requested.subject.enabled=true`. | +| `resource` | No | Target service URI(s), RFC 8707. Absolute URI, no fragment, else `invalid_target`. Repeatable / comma-splittable. | +| `audience` | No | Logical target audience(s). Repeatable / comma-splittable. | + +**Success (`200`):** the standard token response, extended with the RFC 8693 `issued_token_type`: + +```json +{ + "access_token": "<JWT>", + "token_id": "<UUID>", + "token_type": "Bearer", + "issued_token_type": "urn:ietf:params:oauth:token-type:jwt", + "expires_in": 86400, + "managed_token": "true" Review Comment: This is just a sample response, I can change it to `false`. In production development this really depends on the TSS setting on the topology. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
