Adds ID-JAG JWT Bearer grant support (draft-ietf-oauth-identity-assertion-authz-grant-03)

const.go

@@ -29,13 +29,15 @@ const (
 	ClientCredentials   GrantType = "client_credentials"
 	Refreshing          GrantType = "refresh_token"
 	Implicit            GrantType = "__implicit"
+	JWTBearer           GrantType = "urn:ietf:params:oauth:grant-type:jwt-bearer"
 )
 
 func (gt GrantType) String() string {
 	if gt == AuthorizationCode ||
 		gt == PasswordCredentials ||
 		gt == ClientCredentials ||
-		gt == Refreshing {
+		gt == Refreshing ||
+		gt == JWTBearer {
 		return string(gt)
 	}
 	return ""

errors/error.go

@@ -7,13 +7,14 @@ var New = errors.New
 
 // known errors
 var (
-	ErrInvalidRedirectURI   = errors.New("invalid redirect uri")
-	ErrInvalidAuthorizeCode = errors.New("invalid authorize code")
-	ErrInvalidAccessToken   = errors.New("invalid access token")
-	ErrInvalidRefreshToken  = errors.New("invalid refresh token")
-	ErrExpiredAccessToken   = errors.New("expired access token")
-	ErrExpiredRefreshToken  = errors.New("expired refresh token")
-	ErrMissingCodeVerifier  = errors.New("missing code verifier")
-	ErrMissingCodeChallenge = errors.New("missing code challenge")
-	ErrInvalidCodeChallenge = errors.New("invalid code challenge")
+	ErrInvalidRedirectURI             = errors.New("invalid redirect uri")
+	ErrInvalidAuthorizeCode           = errors.New("invalid authorize code")
+	ErrInvalidAccessToken             = errors.New("invalid access token")
+	ErrInvalidRefreshToken            = errors.New("invalid refresh token")
+	ErrExpiredAccessToken             = errors.New("expired access token")
+	ErrExpiredRefreshToken            = errors.New("expired refresh token")
+	ErrMissingCodeVerifier            = errors.New("missing code verifier")
+	ErrMissingCodeChallenge           = errors.New("missing code challenge")
+	ErrInvalidCodeChallenge           = errors.New("invalid code challenge")
+	ErrInsufficientUserAuthentication = errors.New("insufficient_user_authentication")
 )

errors/response.go

@@ -64,6 +64,7 @@ var Descriptions = map[error]string{
 	ErrCodeChallengeRquired:           "PKCE is required. code_challenge is missing",
 	ErrUnsupportedCodeChallengeMethod: "Selected code_challenge_method not supported",
 	ErrInvalidCodeChallengeLen:        "Code challenge length must be between 43 and 128 charachters long",
+	ErrInsufficientUserAuthentication: "The authentication event does not meet the required assurance level",
 }
 
 // StatusCodes response error HTTP status code
@@ -81,4 +82,5 @@ var StatusCodes = map[error]int{
 	ErrCodeChallengeRquired:           400,
 	ErrUnsupportedCodeChallengeMethod: 400,
 	ErrInvalidCodeChallengeLen:        400,
+	ErrInsufficientUserAuthentication: 400,
 }

manage.go

@@ -20,6 +20,7 @@ type TokenGenerateRequest struct {
 	CodeVerifier        string
 	AccessTokenExp      time.Duration
 	Request             *http.Request
+	Assertion           string
 }
 
 // Manager authorization management interface

manage/config.go

@@ -36,4 +36,5 @@ var (
 	DefaultPasswordTokenCfg      = &Config{AccessTokenExp: time.Hour * 2, RefreshTokenExp: time.Hour * 24 * 7, IsGenerateRefresh: true}
 	DefaultClientTokenCfg        = &Config{AccessTokenExp: time.Hour * 2}
 	DefaultRefreshTokenCfg       = &RefreshingConfig{IsGenerateRefresh: true, IsRemoveAccess: true, IsRemoveRefreshing: true}
+	DefaultJWTBearerTokenCfg     = &Config{AccessTokenExp: time.Hour * 2, IsGenerateRefresh: false}
 )

manage/manager.go

@@ -56,6 +56,8 @@ func (m *Manager) grantConfig(gt oauth2.GrantType) *Config {
 		return DefaultPasswordTokenCfg
 	case oauth2.ClientCredentials:
 		return DefaultClientTokenCfg
+	case oauth2.JWTBearer:
+		return DefaultJWTBearerTokenCfg
 	}
 	return &Config{}
 }
@@ -517,3 +519,7 @@ func (m *Manager) LoadRefreshToken(ctx context.Context, refresh string) (oauth2.
 	}
 	return ti, nil
 }
+
+func (m *Manager) SetGrantTypeCfg(gt oauth2.GrantType, cfg *Config) {
+	m.gtcfg[gt] = cfg
+}

server/config.go

@@ -15,6 +15,13 @@ type Config struct {
 	AllowedGrantTypes           []oauth2.GrantType    // allow the grant type
 	AllowedCodeChallengeMethods []oauth2.CodeChallengeMethod
 	ForcePKCE                   bool
+	TrustedIDJAGIssuers         []string                  // iss allowlist
+	IDJAGAudience               string                    // expected aud (RFC 8414 issuer identifier)
+	IDJAGClockSkew              time.Duration             // default 60s applied at runtime
+	IDJAGAllowPublicClients     bool                      // default false
+	IDJAGIssuerKeyResolver      IssuerKeyResolver         // required when JWTBearer enabled
+	IDJAGAuthorizationHandler   IDJAGAuthorizationHandler // policy hook
+	IDJAGReplayStore            oauth2.AssertionReplayStore
 }
 
 // NewConfig create to configuration instance