feat(oauth2): implement Identity Assertion JWT (ID-JAG) issuance (DEP #4600) by kanywst · Pull Request #4611 · dexidp/dex

kanywst · 2026-03-05T16:31:58Z

Overview

Implement ID-JAG (Identity Assertion JWT) token issuance via Token Exchange, per DEP #4600.

What this PR does / why we need it

Adds a new branch to the existing Token Exchange flow that issues ID-JAG tokens (typ: oauth-id-jag+jwt) when
requested_token_type=urn:ietf:params:oauth:token-type:id-jag. This enables cross-domain access brokered by the IdP,
as specified in draft-ietf-oauth-identity-assertion-authz-grant-02.

Key points:

Disabled by default; enabled via oauth2.tokenExchange.tokenTypes
Per-client idJAGPolicies in staticClients control allowed audiences/scopes (default-deny)
Validates subject_token audience against client_id, rejects public clients
OIDC Discovery extended with identity_chaining_requested_token_types_supported
Prometheus counters and structured logging for observability

Phase 2 (accepting ID-JAG as upstream identity via RFC 7523) is out of scope.

Connected DEP: #4600

Special notes for your reviewer

Config example in config.yaml.dist and examples/config-dev.yaml.

kanywst · 2026-03-22T18:40:52Z

Hi @nabokihms @AlwxSin,

DEP #4600 has been merged, and this is the implementation PR. Everything described in the DEP is covered here.

Would appreciate a review when you get a chance.

Thanks!

AlwxSin · 2026-03-24T10:01:28Z

+
+// extractJWTSubAndAud extracts the "sub" and "aud" claims from a JWT without
+// verifying the signature. The aud claim may be a string or []string.
+func extractJWTSubAndAud(token string) (sub string, aud []string, err error) {


I'm concerned that extractJWTSubAndAud doesn't verify signature.

subject_token is an ID token issued by this same server and should be verified against the server's own signing keys. Otherwise an attacker can impersonate any user

Also, this func doesn't check whether the subject token has expired. An expierd ID token can be exchanged for a fresh ID-JAG indefinitely

Thanks.

Fixed in cc4bd0f. This verifies signature, expiry, issuer, and audience.

AlwxSin · 2026-03-24T10:03:57Z

+	}
+
+	if matched == nil {
+		return PolicyResult{


The function returns both a non-nill error and sets Denied: true, which is confusing. I'm not sure which returned variable I should look at.
In Go convention, errors should signal unexpected failures, not business-logic denials.

Fixed in c07a63a. Denials now return Denied: true with nil error

Now no code path returns a non-nil error. Can we we change signature to func evaluateIDJAGPolicy(policies []TokenExchangePolicy, clientID, audience string, scopes []string) PolicyResult {} without an error?

AlwxSin · 2026-03-24T10:06:44Z

 	return fmt.Sprintf("%s.%s.%s", headerB64, payloadB64, signatureB64), nil
 }

+func (v *vaultSigner) SignWithType(ctx context.Context, payload []byte, tokenType string) (string, error) {


Thi func is almost identical to Sign func.
Consider to separate common func logic

func Sign() { return sign(false) } func SignWithType() { return sign(true) } func sign(withType bool) {}

Done. Fixed in 9fd8d05.

AlwxSin · 2026-03-24T10:09:34Z


 		c.PrometheusRegistry.MustRegister(requestCounter, durationHist, sizeHist)

+		// ID-JAG metrics.


Consider adding a check if ID-JAG is enabled. Otherwise there are phantom metrics that never increments, adding noise to monitoring dashboards

Fixed in 4c6664d.

AlwxSin · 2026-03-24T10:11:52Z

 		userIdentity = &ui
 	}

+	// Skip approval if user already consented to the requested scopes for this client.


This check seems unrelated to token exchange. It modifies core auth flow

Removed. Fixed in cc4bd0f.

AlwxSin · 2026-03-24T10:14:39Z

+type idJAGClaims struct {
+	Issuer   string `json:"iss"`
+	Subject  string `json:"sub"`
+	Audience string `json:"aud"`


I don;t know how to follow the RFC in a best way.
RFC allows aud to be either a string or an array. Current draft assumes only a string. So, if the ID-JAG draft allows multi-audience in the future, this will need a breaking change.

Added a comment noting that audience is a single string per the current draft (draft-ietf-oauth-identity-assertion-authz-grant-02).

If multi-audience is added in a future revision, we can update then. Fixed in 9ce3053.

AlwxSin · 2026-03-30T10:00:58Z

+	}
+
+	if matched == nil {
+		return PolicyResult{


Now no code path returns a non-nil error. Can we we change signature to func evaluateIDJAGPolicy(policies []TokenExchangePolicy, clientID, audience string, scopes []string) PolicyResult {} without an error?

AlwxSin · 2026-03-30T10:01:58Z

+// IDJAGEnabled reports whether the ID-JAG token type is enabled.
+func (c TokenExchangeConfig) IDJAGEnabled() bool {
+	for _, t := range c.TokenTypes {
+		if t == "urn:ietf:params:oauth:token-type:id-jag" {


There is a const tokenTypeIDJAG in oauth2.go

Fixed in 98ed352

AlwxSin · 2026-03-30T10:07:03Z

+		return
+	}
+
+	if _, err := s.getConnector(ctx, connectorID); err != nil {


Please, add a comment explaining why the result from s.getConnector is unused. I figured it out only after checking log message

Thanks. Added a comment in f397972

…exidp#4600) Add support for Identity Assertion JWT Authorization Grant (draft-ietf-oauth-identity-assertion-authz-grant-02) as a new requested_token_type in the RFC 8693 Token Exchange flow. - ID-JAG JWT with typ=oauth-id-jag+jwt, required claims (iss, sub, aud, client_id, jti, exp, iat) and optional claims (resource, scope) - Per-client policy with default-deny: allowedAudiences, allowedScopes - Scope filtering per Section 4.3.2 (granted scopes may differ from requested; response includes scope when modified) - subject_token audience validation against client_id (Section 4.3) - Public client rejection (Section 8.1) - OIDC Discovery: identity_chaining_requested_token_types_supported - SignWithType on signer interface for custom JWT typ header - Prometheus counters: dex_id_jag_requests_total, dex_id_jag_policy_rejections_total, dex_id_jag_scope_modifications_total - Structured logging on issuance and rejection with decision context Signed-off-by: Takuma Niwa <takuma@because-and.com> Signed-off-by: kanywst <niwatakuma@icloud.com>

…ange Signed-off-by: kanywst <niwatakuma@icloud.com>

…olicy Signed-off-by: kanywst <niwatakuma@icloud.com>

Signed-off-by: kanywst <niwatakuma@icloud.com>

No code path returns a non-nil error after the earlier refactor that moved policy denials into PolicyResult. Signed-off-by: kanywst <niwatakuma@icloud.com>

Signed-off-by: kanywst <niwatakuma@icloud.com>

…ange Signed-off-by: kanywst <niwatakuma@icloud.com>

AlwxSin

Great job. Thanks.

…id-jag-phase1 # Conflicts: # config.yaml.dist # server/handlers.go

kanywst force-pushed the feature/id-jag-phase1 branch from 135a54a to bdf0a6e Compare March 5, 2026 16:33

kanywst changed the title ~~feat(oauth2): implement Identity Assertion JWT (ID-JAG) issuance (DEP #4600 phase 1)~~ feat(oauth2): implement Identity Assertion JWT (ID-JAG) issuance (DEP #4600) Mar 11, 2026

kanywst marked this pull request as draft March 11, 2026 15:26

kanywst force-pushed the feature/id-jag-phase1 branch from 87e1745 to f1de572 Compare March 14, 2026 10:04

kanywst marked this pull request as ready for review March 14, 2026 10:05

kanywst force-pushed the feature/id-jag-phase1 branch 4 times, most recently from 5b1e4e1 to 63b015e Compare March 18, 2026 17:41

kanywst force-pushed the feature/id-jag-phase1 branch from 63b015e to 5bb1ebf Compare March 22, 2026 18:36

AlwxSin reviewed Mar 24, 2026

View reviewed changes

kanywst force-pushed the feature/id-jag-phase1 branch from b7f4587 to 9ce3053 Compare March 24, 2026 13:28

AlwxSin reviewed Mar 30, 2026

View reviewed changes

kanywst added 9 commits March 30, 2026 19:45

fix(oauth2): verify subject_token signature and expiry in ID-JAG exch…

76191d7

…ange Signed-off-by: kanywst <niwatakuma@icloud.com>

refactor(oauth2): separate policy denial from error in evaluateIDJAGP…

c3a6afe

…olicy Signed-off-by: kanywst <niwatakuma@icloud.com>

refactor(signer): deduplicate Sign and SignWithType into common method

cc9efef

Signed-off-by: kanywst <niwatakuma@icloud.com>

fix(oauth2): register ID-JAG metrics only when enabled

1402367

Signed-off-by: kanywst <niwatakuma@icloud.com>

docs(oauth2): note single audience per ID-JAG draft spec

c83af6d

Signed-off-by: kanywst <niwatakuma@icloud.com>

refactor(oauth2): drop unused error return from evaluateIDJAGPolicy

d1f8ab7

No code path returns a non-nil error after the earlier refactor that moved policy denials into PolicyResult. Signed-off-by: kanywst <niwatakuma@icloud.com>

fix(oauth2): use tokenTypeIDJAG const in IDJAGEnabled

98ed352

Signed-off-by: kanywst <niwatakuma@icloud.com>

docs(oauth2): clarify why getConnector result is unused in token exch…

f397972

…ange Signed-off-by: kanywst <niwatakuma@icloud.com>

kanywst force-pushed the feature/id-jag-phase1 branch from 9ce3053 to f397972 Compare March 30, 2026 10:52

AlwxSin approved these changes Mar 30, 2026

View reviewed changes

nabokihms added the release-note/new-feature Release note: Exciting New Features label Mar 30, 2026

Merge branch 'master' of https://github.com/kanywst/dex into feature/…

bc288b9

…id-jag-phase1 # Conflicts: # config.yaml.dist # server/handlers.go


		c.PrometheusRegistry.MustRegister(requestCounter, durationHist, sizeHist)

		// ID-JAG metrics.

Conversation

kanywst commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

What this PR does / why we need it

Special notes for your reviewer

Uh oh!

kanywst commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlwxSin left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kanywst commented Mar 5, 2026 •

edited

Loading

kanywst commented Mar 22, 2026 •

edited

Loading