Implement the self delegation flow with azp claim inside the act/sub claim by Bin4yi · Pull Request #54 · wso2-extensions/identity-oauth2-grant-token-exchange

Bin4yi · 2026-02-04T16:02:48Z

Purpose

Support self-delegation in OAuth2 Token Exchange (token exchange performed by the same actor) and ensure the azp claim is included inside the act claim.

Description

This PR improves token-exchange handling for self-delegation and strengthens validation logic:

Self-delegation detection
- Enhance isSelfDelegationRequest() to verify the token exchange request contains only a subject token, and that the subject token was issued to the same client.
Avoid act claim duplication
- Prevent duplicate act claim creation during token exchange by checking whether an existing act claim is already present.
- If an act claim exists, preserve it instead of recreating/duplicating it.
Improve subject token validation
- Update validateSubjectTokenForSelfDelegation() to validate mandatory JWT claims.
- Ensure the issuer is properly validated:
  - First, check whether the issuer appears in the audience (aud) list.
  - If not present, validate whether the iss claim matches the JWT token’s issuer.
Add constants
- Introduce constant variables AZP and CLIENT_ID in Constants.java for consistent claim handling.

Sample (sanitized) token exchange request

POST https://localhost:9443/oauth2/token

grant_type: urn:ietf:params:oauth:grant-type:token-exchange
subject_token: <JWT_ACCESS_TOKEN>
subject_token_type: urn:ietf:params:oauth:token-type:access_token
scope: booking:read

Expected (sanitized) response claims

Includes act.sub and ensures act.azp is present under act
Prevents duplicating act when already available
Keeps azp and client binding consistent for self-delegation flows

…claim

CLAassistant · 2026-02-04T16:02:55Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

wso2-engineering

AI Agent Log Improvement Checklist

⚠️ Warning: AI-Generated Review Comments

The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.

✅ Before merging this pull request:

Review all AI-generated comments for accuracy and relevance.
Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.

Comment	Accepted (Y/N)	Reason
#### Log Improvement Suggestion No: 1
#### Log Improvement Suggestion No: 2

- Refactor isSelfDelegationRequest() to accept pre-parsed JWTClaimsSet instead of parsing the subject token internally, and remove throws IdentityOAuth2Exception as it no longer performs operations that can throw - Refactor validateSubjectTokenForSelfDelegation() to accept pre-parsed SignedJWT and JWTClaimsSet parameters instead of parsing internally - Parse subject token once in validateGrant() and pass the result down to isSelfDelegationRequest() and validateSubjectTokenForSelfDelegation(), eliminating duplicate parsing of the same token

- Add @BeforeMethod to reset shared OAuth2AccessTokenReqDTO request parameters before each test, preventing state pollution from tests that set actor_token on the shared DTO - Add ACTOR_SUBJECT_ID constant for delegation test data - Add testValidateDelegationRequest() (disabled) for the delegation positive test case, pending handler fix for isImpersonationRequest() to check may_act claim presence - Add delegationNegativeTestData data provider with 5 negative cases covering missing mandatory claims, wrong issuer, and wrong audience for both subject and actor tokens - Add testValidateDelegationRequestNegativeTest() to verify delegation validation fails with IdentityOAuth2Exception for all 5 negative cases - Add getDelegationSubjectToken(), getDelegationActorToken(), getDelegationReqParams(), and prepareTokenUtilsForDelegation() helper methods following the same pattern as impersonation helpers

…release v1.1.17

…for next development iteration

piraveena · 2026-03-10T06:21:47Z

Can you update the PR description with sample request, and sample JWT access token?

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

piraveena · 2026-03-10T06:25:45Z

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

+        validateMandatoryClaims(claimsSet, subject);
+
+        // NOTE: We SKIP impersonator validation for self-delegation
+        // In self-delegation, there is no may_act claim because the application


where are we skipping this impersonator validation for self-delegation. Couldn't find the logic for that

as we discussed we consider that there is no maay_act claim in delegation or self delegation. may_act is only in impersonation

piraveena · 2026-03-10T06:27:23Z

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

+     * @param tokReqMsgCtx  OAuthTokenReqMessageContext
+     * @return true if the request is a self-delegation request, false otherwise.
+     */
+    private boolean isSelfDelegationRequest(Map<String, String> requestParams, OAuthTokenReqMessageContext tokReqMsgCtx, JWTClaimsSet subjectClaimsSet) {


formatting issue

solved in pr #55

piraveena · 2026-03-10T06:27:57Z

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

+            return false;
+        }
+
+        if (!requestParams.containsKey(TokenExchangeConstants.SUBJECT_TOKEN) ||


this is already captured in line 366. Redundant line

will solve in pr #55

piraveena · 2026-03-10T06:28:15Z

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

+                !requestParams.containsKey(TokenExchangeConstants.SUBJECT_TOKEN_TYPE)) {
+            return false;
+        }
+        if (requestParams.containsKey(TokenExchangeConstants.ACTOR_TOKEN)) {


Handled in 372. Redundant lines

will handle in pr #55

piraveena · 2026-03-10T06:37:50Z

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java

+        }
+
+        // Check if the client_id claim matches the requesting client
+        Object clientIdClaim = subjectClaimsSet.getClaim(TokenExchangeConstants.CLIENT_ID);


azp is an optional claim. Hence we should be able to stick to client_id claim only. Do you have any reasons to fallback to azp and client_id?

Implement the self delegation flow with azp claim inside the act/sub …

e1da2e5

…claim

wso2-engineering bot reviewed Feb 4, 2026

View reviewed changes

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java Outdated Show resolved Hide resolved

wso2-engineering bot reviewed Feb 4, 2026

View reviewed changes

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java Show resolved Hide resolved

wso2-engineering bot suggested changes Feb 4, 2026

View reviewed changes

This was referenced Feb 4, 2026

Improvements on token exchange grant wso2/product-is#26633

Open

Support self-delegation flow without requiring separate actor token wso2/product-is#26677

Open

wso2-engineering bot approved these changes Feb 10, 2026

View reviewed changes

Bin4yi added 3 commits February 10, 2026 14:08

remove comment

69055df

AfraHussaindeen pushed a commit to AfraHussaindeen/identity-oauth2-grant-token-exchange that referenced this pull request Mar 2, 2026

[WSO2 Release] [Jenkins wso2-extensions#54] [Release 1.1.17] prepare …

1564bfb

…release v1.1.17

AfraHussaindeen pushed a commit to AfraHussaindeen/identity-oauth2-grant-token-exchange that referenced this pull request Mar 2, 2026

[WSO2 Release] [Jenkins wso2-extensions#54] [Release 1.1.17] prepare …

30ffaeb

…for next development iteration

piraveena reviewed Mar 10, 2026

View reviewed changes

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java Show resolved Hide resolved

piraveena reviewed Mar 10, 2026

View reviewed changes

...ain/java/org/wso2/carbon/identity/oauth2/grant/token/exchange/TokenExchangeGrantHandler.java Show resolved Hide resolved

piraveena reviewed Mar 10, 2026

View reviewed changes

Bin4yi added a commit to Bin4yi/identity-oauth2-grant-token-exchange that referenced this pull request Mar 10, 2026

resolved comments in pr wso2-extensions#54

b0ccd22

Conversation

Bin4yi commented Feb 4, 2026

Purpose

Description

Sample (sanitized) token exchange request

Expected (sanitized) response claims

Uh oh!

CLAassistant commented Feb 4, 2026

Uh oh!

Uh oh!

Uh oh!

wso2-engineering bot left a comment

Choose a reason for hiding this comment

AI Agent Log Improvement Checklist

Uh oh!

piraveena commented Mar 10, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants