RFC9068: JWT access token

[azmeuk]

Currently we can use OAUTH2_ACCESS_TOKEN_GENERATOR to customize access token generation, so this is not too hard to generate JWTs by re-using mechanisms in generate_id_token.

However the recent RFC9068 standardize the claims the access token should carry.

I suggest making helpers in authlib to produce those tokens:

• helper to generate JWT access token in IdP
• helper to validate JWT access tokens for resource servers
• helpers to validate JWT access token in the IdP introspection endpoint
• token revocation endpoint should reject requests for JWT tokens, and return an unsupported_token_type error

What do you think?

[lepture]

@azmeuk How about adding it to oauth2.rfc9068 package? Can you send a PR for this feature?

[azmeuk]

I might tackle this some day, but I won't probably have time to spent on this feature in a near future.

[azmeuk]

My ideas on how this can be implemented:

• Implement a BearerJWTTokenGenerator class that inherits from BearerTokenGenerator and that builds JWT access tokens. This should be used by IdP to generate JWT access tokens.
• Implement a BearerJWTTokenValidator class that inherits from BearerTokenValidator, that decodes and validates JWT access tokens. This should be used by resource servers to validate JWT access tokens.

I wonder if we need a JWTTokenIntrospectionEndpoint, inheriting from IntrospectionEndpoint and returning token information about JWT access tokens for say resource servers that don't implement RFC9068 yet.

What do you think @lepture?

[lepture]

Sound good to me. And you can use joserfc for JWT purposes. I will replace the authlib.jose module with joserfc.