We're updating the issue view to help you get more done. 

OAuth JWT AccessToken support

Description

Allow to configure OAuth AS endpoint to issue JWT encoded access tokens. Conforming to draft RFC https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-02

Access token should be issued in JWT form only if endpoint is configured so or when requested with accepted MIME type.

JWT token should be usable for authenticating all requests on OAuth endpoint for which bearer token (plain) can be used. oauth-rp authenticator should be able to verify the JWT token. Introspection endpoint should also support its introspection.

JWT token lifetime shouldn't be auto-enhanced in any way as it is possible for plain AT.

 

Note - Support for oauth-rp will be tracked separately and if requested.

Assignee

Krzysztof

Reporter

Krzysztof

Labels

Fix versions

Priority

Medium
Configure