Description

Users should be able to perform the following via token-exchange:

• Reduce the scopes (downscope) of an access token, returning a token with fewer scopes
• Reduce the audiences (downaudience) an access token, returning a token with fewer audiences
• Change the audience (aud) of the target token during token exchange
• Change the authorized party (azp) of the target token during token exchange

Discussion

#26502

Motivation

The token-exchange feature is used for a lot of different use-cases as the token-exchange use-case discussion showed.

We should make it easier to support the mentioned use-cases in a secure and maintainable way.

Details

Other identity providers like curity give users more control over token-exchange: https://curity.io/docs/idsvr/latest/token-service-admin-guide/oauth-flows/index.html#default-oauth-2-0-token-exchange-behaviour