Add Cross App Access to Your OIDC Requesting Application

Summary

OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.

Takeaways

1. 1

   The Identity Assertion Authorization Grant (ID-JAG) is a short-lived JWT issued by the IdP in exchange for the user's refresh token using RFC 8693 Token Exchange.

2. 2

   To obtain an access token, the requesting app redeems the ID-JAG assertion at the resource server's token endpoint using the RFC 7523 JWT bearer grant type.

3. 3

   Because ID-JAG tokens are short-lived, applications must request new ID-JAG tokens using the existing refresh token, re-authenticating the user only when the refresh token expires or gets revoked.