Tapkey Token Exchange - better understanding the token exchange request

user_17053122 0
Viewed 88

Regarding retrieving an access token via tapkey token exchange:

Assuming I have two identity providers registered on Tapkey, which use the same public key: Now I make the request to: POST https://login.tapkey.com/connect/token including in the request body the client id and the provider.

Is it safe to assume, that I will only retrieve access tokens for the Users of the identity provider, which is defined in provider in the request-body? The right identity provider is selected by provider and NOT by the signature of the jwt-token I am sending for exchange, right?

tapkey access-token
1 Answers

Right, the signature itself is only used for validation.

The provider of the request will be the identity provider in the exchanged token.

But:

  • The client must be setup to use this identity provider
  • The subject token must be signed with the configured token
  • The audience and issuer claim in the subject token must match the configured identity provider.
  • ...

It is fine to use the same private key to sign jwt tokens for multiple identity providers. But the audience should be different to disallow an interchange of tokens between different identity providers.

Normally we wouldn't expect the need of multiple identity providers, except the users has to be strictly separated.

user_159804870
Related