diff --git a/backend/internal/oauth/oauth2/granthandlers/ciba.go b/backend/internal/oauth/oauth2/granthandlers/ciba.go index 2b376d8e78..61bccf1857 100644 --- a/backend/internal/oauth/oauth2/granthandlers/ciba.go +++ b/backend/internal/oauth/oauth2/granthandlers/ciba.go @@ -232,11 +232,15 @@ func (h *cibaGrantHandler) issueTokens(ctx context.Context, record *ciba.CIBAAut OAuthApp: oauthApp, ValidityPeriod: userSubConfig.ValidityPeriodOrZero(), DPoPJkt: dpop.GetJkt(ctx), +<<<<<<< HEAD } if oauthApp.ShouldAppendActorClaim() { accessTokenCtx.ActorClaims = &tokenservice.SubjectTokenClaims{Sub: oauthApp.ID} } accessToken, err := h.tokenBuilder.BuildAccessToken(ctx, accessTokenCtx) +======= + }) +>>>>>>> 6e54c09ea (Bind CIBA-issued access tokens to the DPoP proof key) if err != nil { h.logger.Error(ctx, "Failed to generate access token", log.Error(err)) return nil, &model.ErrorResponse{ diff --git a/backend/internal/oauth/oauth2/tokenservice/validator.go b/backend/internal/oauth/oauth2/tokenservice/validator.go index cde2e79bba..d017cb07a3 100644 --- a/backend/internal/oauth/oauth2/tokenservice/validator.go +++ b/backend/internal/oauth/oauth2/tokenservice/validator.go @@ -44,8 +44,14 @@ type TokenValidatorInterface interface { // refresh token into an ID-JAG. ValidateIDJAGSubjectToken(ctx context.Context, token string, oauthApp *providers.OAuthClient) ( *SubjectTokenClaims, error) +<<<<<<< HEAD // ValidateIDJAGAssertion validates an ID-JAG assertion presented on the jwt-bearer grant. ValidateIDJAGAssertion(ctx context.Context, assertion string) (*IDJAGAssertionClaims, error) +======= + // ValidateIDJAGAssertion validates an ID-JAG assertion presented on the jwt-bearer grant, + // binding it to the authenticated client via its client_id claim. + ValidateIDJAGAssertion(ctx context.Context, assertion, clientID string) (*IDJAGAssertionClaims, error) +>>>>>>> abe9097b8 (Restrict introspect to access and refresh tokens) } // TokenValidator implements TokenValidatorInterface.