8000 Identity Assertion JWT Authorization Grant · Issue #43971 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Identity Assertion JWT Authorization Grant #43971

New issue
New issue
Open
feature
0 of 2 issues completed
Open
Identity Assertion JWT Authorization Grant#43971
feature
0 of 2 issues completed
Assignees
tnorimat
Labels
area/token-exchange/federatedFederated token exchange — JWT Authorization Grant (RFC 7523), IdP trustkind/featureCategorizes a PR related to a new featurestatus/labeled-by-botIssue type or area was assigned automatically by the triage botstatus/triageteam/core-protocols
Milestone
27.0 Development Milestone

Description

@stianst
stianst
opened on Nov 5, 2025

Description

Identity Assertion JWT Authorization Grant builds on Identity Chaining Across Trust Domains to cover scenarios within a single enterprise.

An example use-case enabled by ID-JAG is a scenario where an enterprise uses a SaaS service configured with the corporate IdP for single sign-on using, and at the same time allowing direct API access to a resource server by allowing an ID-JAG to be used to obtain an access token from the SaaS service authorization server.

Value Proposition

Enables SaaS services to offer better integration with the enterprise IdP. ID-JAG will also be included in the next MCP specification.

Goals

  • Add support for ID-JAG to Keycloak

Non-Goals

Discussion

No response

Notes

No response

Activity

  1. stianst
    added the
    feature
    issue type on Nov 5, 2025
  2. stianst
    added
    kind/featureCategorizes a PR related to a new feature
    status/triage
    on Nov 5, 2025
  3. stianst
    marked this as blocked by 2 issues on Nov 5, 2025
  4. stianst
    marked this as blocking on Nov 5, 2025
  5. stianst
    assigned
    tnorimat
    on Nov 5, 2025

  6. tnorimat commented on Nov 5, 2025

    @tnorimat
    tnorimat
    on Nov 5, 2025
    Contributor

    @stianst Thank you for creating the issue. I would like to write its details afterwards.

  7. tnorimat commented on Nov 5, 2025

    @tnorimat
    tnorimat
    on Nov 5, 2025
    Contributor

    Identity Assertion JWT Authorization Grant leverages RFC 8693 Token Exchange and RFC 7523 JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants and is discussed in the MCP community SEP-646: Enterprise-Managed Authorization Profile for MCP. The spec is for enterprise-ready MCP.

  8. stianst
    added
    team/core-clients
    on Jan 6, 2026

  9. tnorimat commented on Jan 30, 2026

    @tnorimat
    tnorimat
    on Jan 30, 2026
    Contributor

    @stianst Hello, my colleague is now working for the issue. The PR will be submitted afterwards.

  10. mposolda
    added
    team/core-protocols
    and removed
    team/core-clients
    on Apr 29, 2026
  11. stianst
    added this to the 26.7.0 milestone on Apr 29, 2026
  12. stianst
    unmarked this as blocking on May 11, 2026
  13. mposolda
    added sub-issues on May 14, 2026

  14. tnorimat commented on May 17, 2026

    @tnorimat
    tnorimat
    on May 17, 2026
    Contributor

    @stianst Hello,

    Regarding ID-JAG, there are two roles: consumer and issuer.
    The existing issues/PRs are about keycloak as a consumer of ID-JAG.
    Therefore, how about adding the goal to the issue as follows?

    • Keycloak works as a consumer of ID-JAG

    Regarding ID -JAG as an issuer, my colleague created the issue for ID-JAG as an issuer .

  15. mposolda
    modified the milestones: 26.7.0, 26.8.0 on Jun 15, 2026
  16. christopher-svensson-stegra
    added a commit that references this issue on Aug 19, 2026

    Support lightweight tokens for JWT authorization grants

    6f36ef1
  17. craigk5n
    added a commit that references this issue on Sep 5, 2026

    docs: settle whether Keycloak can issue ID-JAGs (it cannot)

    fbcc5aa
  18. stianst
    added this to Keycloak Roadmapon Sep 10, 2026
  19. github-project-automation
    moved this to Backlog in Keycloak Roadmapon Sep 10, 2026
  20. stianst
    set
    Votes
    to
    16
    on Sep 11, 2026
  21. stianst
    modified the milestones: 26.8, 27.0 Development Milestone on Sep 11, 2026
  22. ahus1
    added
    area/token-exchange/federatedFederated token exchange — JWT Authorization Grant (RFC 7523), IdP trust
    status/labeled-by-botIssue type or area was assigned automatically by the triage bot
    on Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/token-exchange/federatedFederated token exchange — JWT Authorization Grant (RFC 7523), IdP trustkind/featureCategorizes a PR related to a new featurestatus/labeled-by-botIssue type or area was assigned automatically by the triage botstatus/triageteam/core-protocols

Type

feature

Fields

Value

None yet

Effort

None yet

Votes

16

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions
0