{"id":"bacf8877-a4ae-41ac-8b0b-113b17fc0779","task":"Implement OAuth 2.0 Token Exchange (RFC 8693) for service-to-service delegation with subject_token validation","domain":"rfc-editor.org","steps":["At the AS token endpoint, accept grant_type urn:ietf:params:oauth:grant-type:token-exchange with parameters: subject_token, subject_token_type (e.g. urn:ietf:params:oauth:token-type:access_token or id_token), requested_token_type, audience, scope, and optionally actor_token","Validate the subject_token: verify its signature against the issuer's JWKS, check expiry, confirm the subject is allowed to delegate to the requesting client for the requested audience and scopes","For delegation (acting on behalf of a user), issue the new token with an act claim containing {sub: <client_id>} to record the acting party; for impersonation, issue without the act claim","Set the issued_token_type in the response to match the requested_token_type; return the token with appropriate expires_in and scope reflecting what was actually granted (may be narrower than requested)","Enforce authorization policy: the exchanging client must be explicitly authorized to perform token exchange for the subject and the target audience — do not allow any authenticated client to exchange any token","Log the exchange event with subject, actor, target audience, and issued scopes for audit; token exchange chains are a common lateral movement vector if not properly constrained"],"gotchas":["RFC 8693 Token Exchange and OIDC back-channel logout share no mechanism — do not confuse token exchange (delegating access) with token introspection (validating a token's state)","Chained token exchange (A exchanges to get B, B exchanges to get C) can create unbounded delegation chains; implement a maximum delegation depth and record the full may_act chain in the act.act claim to make it auditable","The audience parameter in the exchange request scopes the new token to a specific resource server; if audience is omitted, the issued token may be usable against unintended services — require audience explicitly in sensitive deployments"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/bacf8877-a4ae-41ac-8b0b-113b17fc0779"}