[Wimse] Re: Token Exchange design team update

[John Kemp <[e-mail]>]

On 6/13/24 14:02, Saxe, Dean wrote:
> Second, we have come to the conclusion that token exchange has a 
> distinct meaning due to the use of the term in RFC 8693 
> <https://datatracker.ietf.org/doc/html/rfc8693>. Recognizing that WIMSE 
> is broader than OAuth 2.0 and that there may be exchanges that are lossy 
> between different token types, we have embraced the idea of “token 
> translation” as a term to express that there may be information “lost in 
> translation” in such exchanges.  Where WIMSE can use the existing 
> mechanisms in RFC 8693, we will continue to refer to that as “token 
> exchange”.  In my opinion, token translation is a superset which 
> includes the existing OAuth Token Exchange protocol.  I look forward to 
> broader discussion on this idea with the WIMSE WG.

Just an attempt to understand this concretely, I thought I'd use the 
SPIRE-OIDC-AWSIAM example from the docs:

1. A SPIRE SVID JWT is issued to the workload at some point prior to the 
use of AWS S3, just via the normal SPIRE mechanisms.

2. Once OIDC discovery + IdP in AWS is setup, via OIDC discovery, the 
SPIRE OIDC provider provides an OpenID Connect ID Token to the AWS IdP, 
representing the workload, with the SVID url as its 'sub'. So this has 
been an actual token exchange (of a kind) from one format of JWT to 
another (let's forget there's probably barely any translation needed there).

3. Once the token has been obtained by the client, it can be used to go 
to S3, along with the request to 'assume role' based on that token.

4. The JWT is "translated" (and I think translation sounds more accurate 
than "exchange" here) to an IAM role (which concretely means AWS 
"temporary credentials" - but the client application never sees those 
effectively, so there is no "exchange" as such.

So the overall protocol requires both an actual token exchange (not 
mediated by the client) and a translation.

Did I get that right (in which case, I agree with "translation" being 
needed?)

Cheers, - johnk