feat(oauth2): implement Identity Assertion JWT (ID-JAG) issuance (DEP #4600)#4611

Open

kanywst wants to merge 10 commits intodexidp:masterfrom

kanywst:feature/id-jag-phase1

Commits on Mar 30, 2026

feat(oauth2): implement ID-JAG token issuance via Token Exchange (DEP #4600)
kanywst
committed
fix(oauth2): verify subject_token signature and expiry in ID-JAG exchange
kanywst
committed
refactor(oauth2): separate policy denial from error in evaluateIDJAGPolicy
kanywst
committed
refactor(signer): deduplicate Sign and SignWithType into common method
kanywst
committed
fix(oauth2): register ID-JAG metrics only when enabled
kanywst
committed
docs(oauth2): note single audience per ID-JAG draft spec
kanywst
committed
refactor(oauth2): drop unused error return from evaluateIDJAGPolicy
kanywst
committed
fix(oauth2): use tokenTypeIDJAG const in IDJAGEnabled
kanywst
committed
docs(oauth2): clarify why getConnector result is unused in token exchange
kanywst
committed

Commits on Apr 8, 2026

Merge branch 'master' of https://github.com/kanywst/dex into feature/id-jag-phase1
kanywst
committed