tokenexchange

type TargetTokenExchangeConfig struct {
	// TokenURL is the token endpoint for the target
	TokenURL string `toml:"token_url"`
	// ClientID is the OAuth client ID for the target
	ClientID string `toml:"client_id"`
	// ClientSecret is the OAuth client secret for the target
	ClientSecret string `toml:"client_secret"`
	// Audience is the target audience for the exchanged token
	Audience string `toml:"audience"`
	// SubjectTokenType specifies the token type for the subject token
	// For same-realm: "urn:ietf:params:oauth:token-type:access_token"
	// For cross-realm: "urn:ietf:params:oauth:token-type:jwt"
	SubjectTokenType string `toml:"subject_token_type"`
	// SubjectIssuer is the IDP alias for cross-realm token exchange
	// Only required when exchanging tokens across Keycloak realms
	SubjectIssuer string `toml:"subject_issuer,omitempty"`
	// Scopes are optional scopes to request during token exchange
	Scopes []string `toml:"scopes,omitempty"`
	// CAFile is the path to a CA certificate file for TLS verification
	// Used when the token endpoint uses a certificate signed by a private CA
	CAFile string `toml:"ca_file,omitempty"`
	// AuthStyle specifies how client credentials are sent to the token endpoint
	// "params" (default): client_id/secret in request body
	// "header": HTTP Basic Authentication header
	// "assertion": JWT client assertion (RFC 7523)
	AuthStyle string `toml:"auth_style,omitempty"`
	// ClientCertFile is the path to the client certificate PEM file
	// Used with AuthStyleAssertion for JWT client assertion authentication
	ClientCertFile string `toml:"client_cert_file,omitempty"`
	// ClientKeyFile is the path to the client private key PEM file
	// Used with AuthStyleAssertion for JWT client assertion authentication
	ClientKeyFile string `toml:"client_key_file,omitempty"`
	// AssertionLifetime is the validity duration for generated JWT assertions
	// Defaults to 5 minutes if not specified
	AssertionLifetime time.Duration `toml:"assertion_lifetime,omitempty"`
	// FederatedTokenFile is the path to a file containing a JWT from an external
	// identity provider (e.g., SPIRE JWT-SVID). Used with AuthStyleFederated.
	// The file is re-read on each token request to support token rotation.
	FederatedTokenFile string `toml:"federated_token_file,omitempty"`
	// contains filtered or unexported fields
}

type TokenExchanger interface {
	Exchange(ctx context.Context, cfg *TargetTokenExchangeConfig, subjectToken string) (*oauth2.Token, error)
}