Is your feature request related to a problem? Please describe.
The OAuth working group is currently developing the Identity Assertion JWT Authorization Grant (ID-JAG) draft, which enables applications to obtain access tokens for APIs through a common enterprise identity provider.
At the moment, it would be helpful to track support for this emerging OAuth flow in Authlib. This draft enables cross-application API access scenarios where enterprise identity providers mediate authorization between services.
Describe the solution you'd like
Support for the Identity Assertion JWT Authorization Grant (ID-JAG) draft within Authlib’s OAuth framework.
This flow builds on OAuth 2.0 Token Exchange (RFC 8693) and the JWT Bearer Authorization Grant (RFC 7523) and allows:
- An identity provider to issue an ID-JAG token.
- A client to present that token to a resource authorization server to obtain an access token.
Tracking or supporting this grant would enable Authlib implementations to participate in these emerging OAuth patterns.
Describe alternatives you've considered
Currently, developers would need to implement this flow manually on top of existing Token Exchange or JWT Bearer grant support, which may require custom validation and token handling logic.
Native or extensible support in Authlib would simplify implementation for projects adopting this draft.
Additional context
Is your feature request related to a problem? Please describe.
The OAuth working group is currently developing the Identity Assertion JWT Authorization Grant (ID-JAG) draft, which enables applications to obtain access tokens for APIs through a common enterprise identity provider.
At the moment, it would be helpful to track support for this emerging OAuth flow in Authlib. This draft enables cross-application API access scenarios where enterprise identity providers mediate authorization between services.
Describe the solution you'd like
Support for the Identity Assertion JWT Authorization Grant (ID-JAG) draft within Authlib’s OAuth framework.
This flow builds on OAuth 2.0 Token Exchange (RFC 8693) and the JWT Bearer Authorization Grant (RFC 7523) and allows:
Tracking or supporting this grant would enable Authlib implementations to participate in these emerging OAuth patterns.
Describe alternatives you've considered
Currently, developers would need to implement this flow manually on top of existing Token Exchange or JWT Bearer grant support, which may require custom validation and token handling logic.
Native or extensible support in Authlib would simplify implementation for projects adopting this draft.
Additional context
IETF draft:
https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
Related discussion (Keycloak):
Identity Assertion JWT Authorization Grant keycloak/keycloak#43971