OpenID Connect Token Exchange

Presentation

Token exchange is the process of using a set of credentials or token to obtain an entirely different token, for example to get access to an application not included in current access_token.

Available Token Exchange systems

Tip

The Lemonldap::NG::Portal::Lib::OIDCTokenExchange base class allow developers to easily write some other token exchange systems. See its manpage.

Internal Token Exchange

LemonLDAP::NG provide an internal OIDC token exchange system that allows an OIDC relying party to ask for an access_token available for another.

Configuration

The only thing to configure is to add a list of Relying Party authorized to ask for an access_token into the destination Relying Party. This list contains a space separated of Relying Party names (use the internal LemonLDAP::NG name, not the client ID): “OpenID Connect Relying Party » dest » Options » Advanced » Other RP allowed to exchange access_token”.

How to use it

Request parameters:

  • Authentication (RP source):

    • client_id: the client identifier

    • client_secret if client isn’t public

    • subject_token: the current access_token

  • Oauth2 parameters:

    • grant_type must be urn:ietf:params:oauth:grant-type:token-exchange

    • subject_token_type (optional), only urn:ietf:params:oauth:token-type:access_token is supported here

    • requested_token_type (optional), only urn:ietf:params:oauth:token-type:access_token is supported here

  • Target:

    • audience: the client identifier of the target (not the internal LemonLDAP::NG name)

Exemple:

curl -X POST \
 -d "client_id=clientIdSrc" \
 --data-urlencode "client_secret=ClientSecretSrc" \
 --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
 --data-urlencode "subject_token=accessTokenString" \
 --data-urlencode "requested_token_type=urn:ietf:params:oauth:token-type:access_token" \
 -d "audience=target-client" \
 http://auth.example.com/oauth2/token