Skip to content

feat: RFC 8693 Token Exchange for local Dex tokens #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
sks wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feat: RFC 8693 Token Exchange for local Dex tokens #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ffe1032
feat: handle token exchange for local dex tokens
sks Mar 5, 2026
960c013
Delete .vscode/launch.json
sks Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 63 additions & 17 deletions server/handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1460,23 +1460,69 @@ func (s *Server) handleTokenExchange(w http.ResponseWriter, r *http.Request, cli
return
}

conn, err := s.getConnector(ctx, connID)
if err != nil {
s.logger.ErrorContext(r.Context(), "failed to get connector", "err", err)
s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
return
}
teConn, ok := conn.Connector.(connector.TokenIdentityConnector)
if !ok {
s.logger.ErrorContext(r.Context(), "connector doesn't implement token exchange", "connector_id", connID)
s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
return
}
identity, err := teConn.TokenIdentity(ctx, subjectTokenType, subjectToken)
if err != nil {
s.logger.ErrorContext(r.Context(), "failed to verify subject token", "err", err)
s.tokenErrHelper(w, errAccessDenied, "", http.StatusUnauthorized)
return
var err error
var identity connector.Identity
if connID == "local" || connID == "" {
// Verify local Dex token
verifier := oidc.NewVerifier(s.issuerURL.String(), &signerKeySet{s.signer}, &oidc.Config{SkipClientIDCheck: true})
idToken, err := verifier.Verify(ctx, subjectToken)
if err != nil {
s.logger.ErrorContext(r.Context(), "failed to verify local subject token", "err", err)
s.tokenErrHelper(w, errAccessDenied, "Invalid subject token.", http.StatusUnauthorized)
return
}

var claims idTokenClaims
if err := idToken.Claims(&claims); err != nil {
s.logger.ErrorContext(r.Context(), "failed to decode ID token claims", "err", err)
s.tokenErrHelper(w, errServerError, "Invalid subject token claims.", http.StatusInternalServerError)
return
}

var sub internal.IDTokenSubject
if err := internal.Unmarshal(claims.Subject, &sub); err != nil {
s.logger.ErrorContext(r.Context(), "failed to unmarshal subject", "err", err)
s.tokenErrHelper(w, errServerError, "Invalid subject format.", http.StatusInternalServerError)
return
}

if connID == "" {
connID = sub.ConnId
}

emailVerified := false
if claims.EmailVerified != nil {
emailVerified = *claims.EmailVerified
}

identity = connector.Identity{
UserID: sub.UserId,
Username: claims.Name,
PreferredUsername: claims.PreferredUsername,
Email: claims.Email,
EmailVerified: emailVerified,
Groups: claims.Groups,
}
} else {
conn, err := s.getConnector(ctx, connID)
if err != nil {
s.logger.ErrorContext(r.Context(), "failed to get connector", "err", err)
s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
return
}
teConn, ok := conn.Connector.(connector.TokenIdentityConnector)
if !ok {
s.logger.ErrorContext(r.Context(), "connector doesn't implement token exchange", "connector_id", connID)
s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
return
}

identity, err = teConn.TokenIdentity(ctx, subjectTokenType, subjectToken)
if err != nil {
s.logger.ErrorContext(r.Context(), "failed to verify subject token", "err", err)
s.tokenErrHelper(w, errAccessDenied, "", http.StatusUnauthorized)
return
}
}

claims := storage.Claims{
Expand Down
Loading