[OAUTH-WG] Use OAuth flows to separate authentication from AS

[Thibault Normand <[e-mail]>]

Hello All,

Merry Christmas, Happy new year!

I'm trying to separate the authentication from the authorization server as
a dedicated service. This will allow :
* to have better isolation of often customer-specific code
* to dispatch the load according to the authentication scheme used (Argon2,
etc.)
* to be creative with the authentication process

The idea is to have an API contract based on the assertion flow, where the
assertion is the result of authentication, and authorization (role mapping,
scope expansion, etc.).
This assertion is exchanged using assertion grant type to get an Access
Token which is symbolically used as authentication by reference token.

During AuthCode dance, the user has to be logged in, if not he will be
redirected to the corresponding authentication provider, which will
generate the assertion and the access token.
The authentication provider returned the access token as parameter to the
initial authorization_code request, so that this access token is used to
retrieve the bound identity via an (internal) generic user info call that
we return the ID Token built on authentication phase.

[image: OATH AuthCode + External Login.png]
I saw multiple implementations of the external identity provider pattern,
but they use an additional API served by Authorization Server to handle the
identity binding to the authorization request.

I try to stick with OAuth already defined flows.

Some focus:

   - AccessToken in URL for identity binding => probably need to be
   burn-after-read
   - TokenExchange vs Assertion
   - Probably other things ...

Any thoughts?

Thank you ^^
-- 
Thibault Normand
http://www.zenithar.org