feat(auth): support live Okta OBO token exchange#1681
Conversation
|
I think Keycloak can also be supported for OBO flow with this work. The flow should be similar, the differences would be around configuration. |
afourniernv
force-pushed
the
feat/okta-obo
branch
from
da99ed8 to
ef5a8cf
Compare
usize
left a comment
usize
left a comment
There was a problem hiding this comment.
I was really happy to come across this work, as my team over at Red Hat have been exploring the possibility of leveraging sandbox gateways to achieve obo semantics. \o/
| let token_url = oauth2_token_url(state)?; | ||
| let client_id = required_material(&state.material, "client_id")?; | ||
| let client_secret = required_material(&state.material, "client_secret")?; | ||
| let subject_token = required_material(&state.material, "subject_token")?; |
There was a problem hiding this comment.
Down the line, if we make the subject token a resolvable reference to a SPIFFE SVID, the caller's OIDC bearer, or a gateway-signed assertion this strategy would move further into a general-purpose delegation layer.
We could also support actor tokens and client assertion fields. (fwiw my team has been investigating ways of moving token exchange logic into OpenShell and this would give us what we need).
3 participants
Summary
Adds delegated identity via RFC 8693 / Okta OBO token exchange.
Related Issue
N/A
Changes
Testing
mise run pre-commitpassesChecklist