Token exchange support

[ctriant]

[nsklikas]

Run darker on this. Other than this LGTM.

@rohe @peppelinux what do you think?

[rohe]

Nice set of tests !

[nsklikas]

We merged this in our private fork, here are some things that need to be done:

• Check that the new scopes are a subset of the allowed scopes for the client
• Set the expires_at of the new token to be the same as the original token's. This would stop a client from getting an access token from another client and using token exchange to refresh it indefinitely.
• Do we need to check whether the client using the token is allowed to do so? (in the case where the token wasn't issued for them)

[peppelinux]

@nsklikas we just have two conflicting files right now :)

[melanger]

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

[ctriant]

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

Hello! It is already supported in idpy-oidc. https://github.com/IdentityPython/idpy-oidc/tree/main

[rohe]

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

[melanger]

The default OIDC frontend in SATOSA uses pyop and oic, but I am using satosa-oidcop which uses this library (oidc-op).

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

So which library is the "new" one? I though it is this one.

[rohe]

idpy-oidc is where the action is.

[melanger]

idpy-oidc is where the action is.

So let me recap:

• SATOSA contains OpenIDConnectFrontend based on pyop, that's an "old" one
• satosa-oidcop provides OidcOpFrontend based on oidc-op (this library), which is a "less old" one
• the current library is idpy-oidc, but there is no SATOSA frontend which uses the library

What are the development plans? Are you going to support oidc-op until idpy-oidc is mature enough and integrated with SATOSA?

[rohe]

Good questions all. I'm responsible for the OIDC/OAuth2 libraries within IdentityPython and I would like SATOSA to switch to using idpy-oidc as soon as possible. I think there is a SATOSA frontend, based on idpy-oidc, in the EduTeams implementation but it isn't public yet.