IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Implementing oauth token_exchange flow

    Posted 12/13/24 05:29 AM

    Hello everybody,

    I'm trying to implement an oauth token_exchange flow, where an app A exchanges one of its access_token for a new AT/RT pair targeting app B.

    The token_exchange call itself is being simulated with the following command : 

    curl -X POST -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&client_id=MYAPPA&subject_token=64jg67OUlJ4jxTaHLEPJ&subject_token_type=urn:ietf:params:oauth:token-type:access_token&audience=MYAPPB" "https://mysecure.domain.lu/mga/sps/oauth/oauth20/token"

    I was able to implement different security checks but I cannot find an example showing how I can change the client_id of the newly generated tokens. Those tokens are generated without calling an STS, which I would like to avoid if possible.

    Has anyone some experience with the token_exchange flow ? Is what I'm trying to implement possible with ISVA ? 

    Thank you



    ------------------------------
    André Leruitte
    Security Architect
    POST Luxembourg
    Luxembourg
    ------------------------------


  • 2.  RE: Implementing oauth token_exchange flow

    Posted 01/03/25 05:45 AM

    Hi André,
    I'm also implementing a token exchange mechanism right now. I'm only just discovering this functionnality so I'm in no way an expert.
    We are using JWT tokens, which allow you much more freedom. And with the LocalSTSClient the overhead shouldn't be to big.
    I have now also played around a bit with opaque tokens but I've also not found a way to change the client_id of the generated token.
    The best approach will probably be to use JWT tokens.
    What is your reason for wanting to avoid calling an STS? Just the overhead or are there other considerations?
    Kind regards from Luxembourg (CtiE)



    ------------------------------
    Laurent LA Asselborn
    ------------------------------



  • 3.  RE: Implementing oauth token_exchange flow

    Posted 01/06/25 05:27 AM

    Hi Laurent,

    Glad to hear a reply from a local colleague !

    You are right saying that the overhead of calling STS with LocalSTSClient shouldn't be an issue.

    I wanted to avoid creating additional STS transformations because it's an additional element that needs to be updated every time a certificate involved has to be renewed (in addition to having to maintain and sync between environments).

    As I was unable to find a way to do change the client_id directly in the OAuth Pre/PostToken mapping rule, I finally opted for an alternative solution that fits nicely with the initial requirements : implementing it in an Authentication Policy.

    This new AuthenticationPolicy will only be made available on the reverse proxies concerned and its implementation is quite straight forward :

    • Look for a jwt token in the incoming request
    • Call a STS transfo for validating the JWT (configured with a jwks to simplify certificate management)
    • Perform additional manual validations on the JWT (in particular "aud" claim) 
    • Populate the stsuu with the identification data, so a web session is created

    In the end, it's is not exactly what I aimed for initially, which was exchanging an oauth token from app A to a token for app B, but it fullfills our current need, which is "from an oauth app A I want to open a webview to website B".

    Best regards and happy new year!



    ------------------------------
    André Leruitte
    Security Architect
    POST Luxembourg
    Luxembourg
    ------------------------------

    Original Message


Related Content