search

AdobeDocs / adobeio-auth

Developer documentation for Adobe I/O Authentication.
MIT License
36 stars 69 forks source link

Document access token format (is a JWT itself) #65

Open kwin opened 4 years ago

kwin commented 4 years ago

It seems that the access token being issued by https://www.adobe.io/authentication/auth-methods.html#!AdobeDocs/adobeio-auth/master/JWT/JWT.md#exchanging-jwt-to-retrieve-an-access-token is a JWT itself but it doesn't seem to follow https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07#section-2.

By looking at the AEM client (com.adobe.granite.auth.ims.impl.IMSTokenValidatorImpl) I assume that at least the following claims are contained in there

  1. created_at
  2. expires_in

Please document the format of the access token so that it can be validated without having to consider the other properties from the OAuth response (https://tools.ietf.org/html/rfc6749#section-4.1.4).