tokenexchange

Aug 26, 2026

Changes in this version

+ func FactoryWithSharedTrustedIssuerValidator(delegationLifespan time.Duration, trustedIssuers []TrustedIssuer, ...) (server.Factory, error)

+ func JWTBearerIssuanceFactory(trustedIssuers []TrustedIssuer, shared *MultiIssuerTokenValidator) (server.Factory, error)

+ type JWTBearerAssertionValidator interface

+ ValidateJWTBearerAssertion func(ctx context.Context, rawToken, tokenEndpoint string) (*ValidatedClaims, error)

+ type JWTBearerGrantPolicy struct

+ AcceptedAudiences []string

+ MaxAssertionAge string

+ SubjectBindings []JWTBearerSubjectBinding

+ type JWTBearerHandler struct

+ func (*JWTBearerHandler) CanHandleTokenEndpointRequest(_ context.Context, requester fosite.AccessRequester) bool

+ func (*JWTBearerHandler) CanSkipClientAuth(ctx context.Context, requester fosite.AccessRequester) bool

+ func (h *JWTBearerHandler) HandleTokenEndpointRequest(ctx context.Context, requester fosite.AccessRequester) error

+ func (h *JWTBearerHandler) PopulateTokenEndpointResponse(ctx context.Context, requester fosite.AccessRequester, ...) error

+ type JWTBearerSubjectBinding struct

+ AllowedResources []string

+ Subject string

type MultiIssuerTokenValidator

+ func NewSharedTrustedIssuerValidator(config *server.AuthorizationServerConfig, trustedIssuers []TrustedIssuer) (*MultiIssuerTokenValidator, error)

+ func (v *MultiIssuerTokenValidator) ValidateJWTBearerAssertion(ctx context.Context, rawToken, tokenEndpoint string) (*ValidatedClaims, error)

type TrustedIssuer

+ ActorMatcher string

+ JWTBearerGrant *JWTBearerGrantPolicy

+ func ResolveJWTBearerGrantPolicies(issuers []TrustedIssuer) ([]TrustedIssuer, error)

type ValidatedClaims

+ ExternalActorAuthorized bool

Aug 18, 2026

Changes in this version

type TrustedIssuer

+ AllowMayAct bool

Aug 10, 2026

Changes in this version

+ func ValidateJWKSURL(jwksURL string, insecureAllowHTTP, allowPrivateIPs bool) error

+ func ValidateTrustedIssuers(trustedIssuers []TrustedIssuer, selfIssuer string) error

type MayActClaim

+ Iss string

type TrustedIssuer

+ ActorClaim string

+ AllowPrivateIPs bool

+ AllowedActors []string

+ AllowedDelegateClients []string

+ InsecureAllowHTTP bool

type ValidatedClaims

+ AllowedDelegateClients []string

+ ExternalActor string

+ ExternalIssuer string

Jul 28, 2026

Changes in this version

+ type MultiIssuerTokenValidator struct

+ func NewMultiIssuerTokenValidator(selfValidator *SelfIssuedTokenValidator, selfIssuer string, ...) (*MultiIssuerTokenValidator, error)

+ func (v *MultiIssuerTokenValidator) Validate(ctx context.Context, rawToken string) (*ValidatedClaims, error)

+ type SelfIssuedTokenValidator struct

+ func NewSelfIssuedTokenValidator(jwks *jose.JSONWebKeySet, issuer string, allowedAudiences []string) (*SelfIssuedTokenValidator, error)

+ func (v *SelfIssuedTokenValidator) Validate(_ context.Context, rawToken string) (*ValidatedClaims, error)

+ type TrustedIssuer struct

+ ExpectedAudience string

+ IssuerURL string

+ JWKSURL string

Jul 17, 2026

Changes in this version

+ func Factory(delegationLifespan time.Duration) (server.Factory, error)

+ type Handler struct

+ func (*Handler) CanHandleTokenEndpointRequest(_ context.Context, requester fosite.AccessRequester) bool

+ func (*Handler) CanSkipClientAuth(_ context.Context, _ fosite.AccessRequester) bool

+ func (h *Handler) HandleTokenEndpointRequest(ctx context.Context, requester fosite.AccessRequester) error

+ func (h *Handler) PopulateTokenEndpointResponse(ctx context.Context, requester fosite.AccessRequester, ...) error

+ type MayActClaim struct

+ Sub string

+ type SubjectTokenValidator struct

+ func NewSubjectTokenValidator(jwks *jose.JSONWebKeySet, issuer string, allowedAudiences []string) (*SubjectTokenValidator, error)

+ func (v *SubjectTokenValidator) Validate(_ context.Context, rawToken string) (*ValidatedClaims, error)

+ type ValidatedClaims struct

+ Audience []string

+ ClientID string

+ Email string

+ Expiry time.Time

+ Extra map[string]any

+ IssuedAt time.Time

+ Issuer string

+ JWTID string

+ MayAct *MayActClaim

+ Name string

+ Scopes string

+ Subject string