Ryan Richard 0bb2c7beb7 Always add the azp claim to ID tokens to show the original client ID ...

When the token exchange grant type is used to get a cluster-scoped
ID token, the returned token has a new audience value. The client ID
of the client which performed the authorization was lost. This didn't
matter before, since the only client was `pinniped-cli`, but now that
dynamic clients can be registered, the information would be lost in the
cluster-scoped ID token. It could be useful for logging, tracing, or
auditing, so preserve the information by putting the client ID into the
`azp` claim in every ID token (authcode exchange, clsuter-scoped, and
refreshed ID tokens).

2022-08-09 16:07:23 -07:00

..

callback_handler_test.go

Create username scope, required for clients to get username in ID token

2022-08-08 16:29:22 -07:00

callback_handler.go

Always add the azp claim to ID tokens to show the original client ID

2022-08-09 16:07:23 -07:00