riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint #10

New Issue
Open
opened 2026-09-08 04:42:06 +00:00 by rock · 0 comments
rock commented 2026-09-08 04:42:06 +00:00
Owner
Copy Link
Copy Source

Summary

POST /auth/exchange — service presents user JWT + own credentials, gets scoped token for downstream with both identities.

Code repo: rock/homelab-frontend

Request

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=<user JWT>
subject_token_type=urn:ietf:params:oauth:token-type:access_token
client_id=portfolio-agent
client_secret=<service secret>
scope=memory:read
resource=poimen-memory

Response JWT claims

{
  "sub": "rock",
  "azp": "portfolio-agent",
  "act": {"sub": "portfolio-agent"},
  "roles": ["memory:read"],
  "aud": "poimen-memory"
}

Investigation needed

  • Does Authentik support RFC 8693 natively?
  • If no: gateway-minted tokens with own signing key

Acceptance Criteria

  • New token has act claim (RFC 8693 actor)
  • Scope cannot escalate (subset of actor roles only)
  • Subject token expiry checked before exchange
  • Exchanged token has shorter TTL than subject
  • Audit log entry for every exchange

Depends on

  • P3.2, P3.4
## Summary `POST /auth/exchange` — service presents user JWT + own credentials, gets scoped token for downstream with both identities. **Code repo:** `rock/homelab-frontend` ## Request ``` grant_type=urn:ietf:params:oauth:grant-type:token-exchange subject_token=<user JWT> subject_token_type=urn:ietf:params:oauth:token-type:access_token client_id=portfolio-agent client_secret=<service secret> scope=memory:read resource=poimen-memory ``` ## Response JWT claims ```json { "sub": "rock", "azp": "portfolio-agent", "act": {"sub": "portfolio-agent"}, "roles": ["memory:read"], "aud": "poimen-memory" } ``` ## Investigation needed - [ ] Does Authentik support RFC 8693 natively? - [ ] If no: gateway-minted tokens with own signing key ## Acceptance Criteria - [ ] New token has `act` claim (RFC 8693 actor) - [ ] Scope cannot escalate (subset of actor roles only) - [ ] Subject token expiry checked before exchange - [ ] Exchanged token has shorter TTL than subject - [ ] Audit log entry for every exchange ## Depends on - P3.2, P3.4
rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:42:06 +00:00
rock self-assigned this 2026-09-08 04:42:09 +00:00
rock added this to the API-GW OAuth project 2026-09-08 04:43:58 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code (homelab-frontend)
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels area/auth area/authentik area/gateway priority/high status/todo type/feature
Milestone
No items
No Milestone Phase 3: OAuth2 Token Exchange & Identity Propagation
Projects
Clear projects
No projects
API-GW OAuth
Backlog
Assignees
Clear assignees
poimen rock (Rock)
No Assignees rock
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#10