[OAUTH-WG] Token exchange use cases

George Fletcher <gffletch@aol.com> Thu, 07 December 2017 17:00 UTC

To: "oauth@ietf.org" <oauth@ietf.org>
From: George Fletcher <gffletch@aol.com>
Organization: AOL LLC
Message-ID: <e80abfc8-be9f-e435-0251-9b8a043b145b@aol.com>
Date: Thu, 07 Dec 2017 12:00:10 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.5.0
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------5E82469B1E037FDBA22396F1"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/5Z8WNdKxHS4rZIg6mus7MftVSoc>
Subject: [OAUTH-WG] Token exchange use cases
Precedence: list

I have a use case for which I'd like to leverage the token exchange spec...

1. As part of an identity migration effort, I'd like to exchange a 
refresh_token issued by one AS for a refresh_token, access_token and 
potentially id_token issued by a second AS.

For this use case I have two questions...

    -- does the spec allow me to extend the response to include an 
additional "claim" in the response?
        refresh_token and access_token are already defined, but id_token 
is not

    -- what would I use as the desired "requested_token_type"?
        should it be a "virtual" token type that then represents the 
tokens to be returned in the response?
        It looks like I could also leave the "requested_token_type" 
blank and just let the AS do what it wants. Is that the best option?

Thanks,
George

[OAUTH-WG] Token exchange use cases George Fletcher