Most "identity federation" demos stop at login. The harder problem is what happens after login: how does App B get a token to call App C on a user's behalf, without App B ever holding the user's original credentials — and without the user re-authenticating at every hop?
That's the problem xaa-id-jag-poc is built to explore.
What it is
A working proof-of-concept for cross-app access (XAA) using the emerging ID-JAG (Identity Assertion JWT Authorization Grant) draft spec, layered on top of standard OAuth 2.0 building blocks:
- RFC 8693 — OAuth 2.0 Token Exchange
- RFC 7523 — JWT Bearer Grant for OAuth
- RFC 7636 — PKCE
- ID-JAG (draft) — exchanging an ID Token from a trusted IdP for an access token scoped to a downstream Resource Authorization Server
In plain terms: a user authenticates once at an Identity Provider, and their identity assertion can then be exchanged — hop by hop — for scoped access tokens at other services, without those services ever seeing a password or a long-lived credential.
Architecture
- Spring Authorization Server — acts as both the Identity Provider and the Resource Authorization Server
- Spring Boot — protected Resource API validating the exchanged tokens
- Next.js + TypeScript — the web UI driving the flows
- Nginx — reverse proxy handling hostname routing between services
- Docker Compose / Helm — local orchestration and a full Kubernetes deployment path
There's also MCP (Model Context Protocol) resource URI support, which lets you point the same token-exchange machinery at MCP-style endpoints — relevant if you're thinking about how AI agents should authenticate to tools and downstream APIs rather than being handed a static bearer token.
What's been shaking out recently
The repo has been getting hardened with negative-path test coverage — the boring but critical part of any auth system:
- Correct propagation of MCP auth failures as HTTP 401/403 (instead of leaking through as 500s or ambiguous errors)
- Explicit incorrect-scope test cases across both the MCP and web test suites
- Fixes to JWT bearer issuer extraction, plus stabilized REST paths for the positive-flow tests
If you've ever shipped a token-exchange flow, you know the negative cases are where the real bugs live — a wrong scope or a bad issuer claim needs to fail loudly and specifically, not silently degrade into "well, it kind of works."
Try it
Everything runs locally via Docker Compose with pre-configured dev credentials and hostname routing, so you can watch the full token-exchange chain happen end-to-end without standing up real infrastructure. A Helm chart is included if you want to push it onto Kubernetes with a private registry.
Repo: https://github.com/darkedges/xaa-id-jag-poc
If you're working on agent-to-agent auth, MCP security, or just want to see RFC 8693 token exchange actually wired up rather than described in a spec doc, it's worth a clone and a poke around. Issues and PRs welcome.
Top comments (0)