Karl McGuinness mcguinness

Cross-Client Delegation for OAuth 2.0 Token Exchange

Draft response to ID-JAG issue #114 (Architectural Conflict in Gateway / Proxy Topology with Public Clients).

This gist contains two documents:

Token Exchange Profile for Cross-Client Delegation — a generic mechanism sketch. Defines the Cross-Client Delegation Relationship (CCDR), actor_token handling, may_act interaction, and act claim construction at the Token Exchange layer. Factors out the shape that OpenID Connect cross-client identity, the ID-JAG Broker case, and similar patterns all implement.
ID-JAG Enterprise Broker Deployment Pattern — an informative deployment pattern applying the generic profile to ID-JAG. Describes the enterprise MDM + gateway topology, the authenticated handoff and correlation controls the Broker enforces, client_id namespace handlin

Problem Statement

The OAuth 2.0 Authorization Framework defines the authorization_code grant type and refresh token. It doesn't establish any rules for issuing refresh tokens and explicitly states in Section 1.5 that "Issuing a refresh token is optional at the discretion of the authorization server". One of the explicit goals for Rfc6749 was to enable offline access to protected resources when the end-user is not present. It does not define any request semantics for how a client can explicitly request a refresh token or whether that refresh token's lifecycle should be bound to the user's session that granted the refresh token. Authorization Servers are free to define these behaviors on a per-implementation or policy basis.

OpenID Connect being the identity layer ontop of OAuth 2.0 needed to define some new authorization server behaviors to enable end-user consent for when a client can access their identity info

Keybase proof

I hereby claim:

I am mcguinness on github.
I am mcguinness (https://keybase.io/mcguinness) on keybase.
I have a public key whose fingerprint is DDF0 E3D1 7A4C 5192 A9D1 0BF7 4E27 92F7 5D23 D9F0

To claim this, I am signing this object:

Multiple SSH Keys settings for different github account

create different public key

create different ssh key according the article Mac Set-Up Git

$ ssh-keygen -t rsa -C "your_email@youremail.com"

	#!/usr/bin/env bash

	# Quinn Comendant <quinn@strangecode.com>
	# https://gist.github.com/quinncomendant/3be731567e529415d5ee
	# Since 25 Jan 2015
	# Version 1.1

	CMD=$1;

	if [[ `id -u` = 0 ]]; then