Description

This is to check if during external-internal token exchange, the internal client foo is allowed to exchange the token, which was issued by the IDP bar .

Current behaviour: In token-exchange:v1, the verification is done by FGAP. It requires FGAP:v1 to be enabled instead of supported FGAP:v2

Proposal: For token-exchange-external-internal:v2, we will not rely on FGAP similarly like we not rely on it for standard token exchange.

The details are mentioned in google doc https://docs.google.com/document/d/1hmUpMfvAwyRBvUhCD01IEGNjx1yIh9a8FpGCQlmrOno/edit?tab=t.0#heading=h.b1u2si558myi .