According to the OAuth JWT Bearer grant spec, a valid JWT should have some sort of identifier (token endpoint may be used) of the token issuing authorization server within the audience claim.

The JWT MUST contain an "aud" (audience) claim containing a value that identifies the authorization server as an intended audience. The token endpoint URL of the authorization server MAY be used as a value for an "aud" element to identify the authorization server as an intended audience of the JWT. The Authorization Server MUST reject any JWT that does not contain its own identity as the intended audience In the absence of an application profile specifying otherwise, compliant applications MUST compare the audience values using the Simple String Comparison method defined in Section 6.2.1 of RFC 3986 [RFC3986]. As noted in Section 5, the precise strings to be used as the audience for a given Authorization Server must be configured out-of-band by the Authorization Server and the Issuer of the JWT.

So how can we obtain a JWT with our required audience claim from an IDP to be used as a JWT bearer grant? Is it valid to use OpenID token as a JWT bearer grant?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.