# OpenID Connect Token Exchange

## Presentation

Token exchange is the process of using a set of credentials or token to obtain an entirely different token, for example to get access to an application not included in current `access_token`.

## Available Token Exchange systems

Tip

The `Lemonldap::NG::Portal::Lib::OIDCTokenExchange` base class allow developers to easily write some other token exchange systems. See its manpage.

### Internal Token Exchange

LLNG provide an internal OIDC token exchange system that allows an OIDC relying party to ask for an access_token available for another.

#### Configuration

The only thing to configure is to add a list of Relying Party authorized to ask for an access_token into the destination Relying Party. This list contains a space separated of Relying Party names (use the internal LLNG name, not the client ID): “OpenID Connect Relying Party » dest » Options » Advanced » Other RP allowed to exchange access_token”.

#### How to use it

Request parameters:

- Authentication (RP source):

  - `client_id`: the client identifier

  - `client_secret` if client isn’t public

  - `subject_token`: the current `access_token`

- Oauth2 parameters:

  - `grant_type` must be `urn:ietf:params:oauth:grant-type:token-exchange`

  - `subject_token_type` (optional), only `urn:ietf:params:oauth:token-type:access_token` is supported here

  - `requested_token_type` (optional), only `urn:ietf:params:oauth:token-type:access_token` is supported here

- Target:

  - `audience`: the client identifier of the target (not the internal LLNG name)

Exemple:

    curl -X POST \
     -d "client_id=clientIdSrc" \
     --data-urlencode "client_secret=ClientSecretSrc" \
     --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
     --data-urlencode "subject_token=accessTokenString" \
     --data-urlencode "requested_token_type=urn:ietf:params:oauth:token-type:access_token" \
     -d "audience=target-client" \
     http://auth.example.com/oauth2/token