Search code examples
oauthjwtaccess-tokenoktapingfederate

Difference between jwt-bearer and token-exchange grant types

What are the main differences between grant types "urn:ietf:params:oauth:grant-type:jwt-bearer (https://www.rfc-editor.org/rfc/rfc7523) and "urn:ietf:params:oauth:grant-type:token-exchange" (https://www.rfc-editor.org/rfc/rfc8693).

Solution
    • "urn:ietf:params:oauth:grant-type:jwt-bearer" is a URN defined as a JWT Bearer Token by OAuth 2.0 Authorization server (uses OAuth2.0 Authorization grant type ).
    • "urn:ietf:params:oauth:grant-type:token-exchange" is a URN defined as a JWT Bearer Token by OAuth 2.0 Authorization server (uses OAuth2.0 Token Exchange grant type).

    Notes:

    1. jwt-bearer means whoever bearing the JWT token shall be given access to the requested resource.
    2. token-exchange is basically used for user impersonation and delegation purpose. Typically used by a support person who exchange his/ her JWT bearer token to impersonate as an end-user to request the end-user's resource to help in live-debugging of issue (or) exchange another JWT bearer token for a given token for a downstream systems.