Support JWT as an Authorization Grant for client

This feature will partially implement JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants.

Section 2.1. Using JWTs as Authorization Grants will be the focus for this feature implementation.

JWT Bearer Token can be used to request an access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of the JWT, without a direct user-approval step at the authorization server

One of the primary use cases for using a JWT as an authorization grant is to exchange it for another JWT (at the Token Endpoint) with narrowed scope. This is useful when a service (a) wants to call another downstream service (b) with only scope that service (b) understands (supports).

NOTE: This ticket addresses client-side support only.

Related #5199 #8175

[matt-domsch-sp]

I’m aware of these uses in the wild:

• Ping Federate: https://www.pingidentity.com/en/company/blog/posts/2017/the-latest-pingfederate-release-open-banking-and-much-more.html
• Okta: https://developer.okta.com/docs/guides/build-self-signed-jwt/java/overview/
• Apigee: https://community.apigee.com/articles/35738/rfc7523-in-apigee-edge-exchanging-jwt-for-opaque-o.html
• Atlassian: https://community.developer.atlassian.com/t/jira-authentication-query/20808
• Salesforce: https://help.salesforce.com/articleView?id=remoteaccess_asset_token_using_validating.htm&type=5

Other participants in the FastFed WG include SailPoint, Microsoft, Google, AWS, Yahoo, ADP, Ping, Okta, so I would expect broader adoption through 2020 and 2021.

[mjeffrey]

@H-LREB Yes indeed. FYI I just searched the keycloak source code (server and client) for jwt-bearer and there is only the assertion so urn:ietf:params:oauth:grant-type:jwt-bearer may not be supported?

Thanks for the info on gh-8175 - that is the one I’m interested in 😄 .