Improvements on token exchange grant

[piraveena]

Current Limitation

There are few improvements needed in token exchange grant

Suggested Improvement

• Support for Nested act/sub Claims
• Support for one or multiple Audience Parameter in Token Exchange Requests
• Trust the tokens issued by WSO2 IS for internal token exchanges
• Support for actor tokens

Please select the area issue is related to

Other

Version

No response

Developer Checklist

• [Behavioural Change] Does this change introduce a behavioral change to the product?
•  ↳ Approved by team lead
•  ↳ Label impact/behavioral-change added
• [Migration Impact] Does this change have a migration impact?
•  ↳ Migration label added (e.g., 7.2.0-migration)
•  ↳ Migration issues created and linked
• [New Configuration] Does this change introduce a new configuration?
•  ↳ Label config added
•  ↳ Configuration is properly documented

[Bin4yi]

Update / Tracking Comment

All items requested under the token exchange grant improvements have now been implemented:

• Support for actor tokens in token exchange

• fix impersonation, delegation and self-delegation flow with chained act/sub claims and azp claim inside it wso2-extensions/identity-oauth2-grant-token-exchange#55

• Fix impersonation flow with checking MAY_ACT claim wso2-extensions/identity-oauth2-grant-token-exchange#56

• Support for nested act/sub claims in the delegation chain

• Supports nested act sub claim with azp claim inside it wso2-extensions/identity-inbound-auth-oauth#3028

• Support for one or multiple audience parameters in Token Exchange requests

• Fix support for multiple audience values in single audience parameter wso2-extensions/identity-oauth2-grant-token-exchange#58

• Use DELEGATING_ACTOR constant and support audince parameter in token request to support multiple audiences in single audience claim wso2-extensions/identity-inbound-auth-oauth#3029

• Trust tokens issued by WSO2 IS for internal token exchanges

• Fix checking iss claim when issuer is not in the audience list wso2-extensions/identity-oauth2-grant-token-exchange#57

• Make actor token optional when delegation is done by the same actor

• Implement the self delegation flow with azp claim inside the act/sub claim wso2-extensions/identity-oauth2-grant-token-exchange#54

• Support azp claim inside the nested act/sub claim

• Supports nested act sub claim with azp claim inside it wso2-extensions/identity-inbound-auth-oauth#3028

Marking this issue as completed from implementation side.