Repository navigation
Identity Assertion Grant flow only supports OIDC ID tokens, not SAML 2.0 assertions #1618
Description
IdentityAssertionGrantProvider (added in #1305) hardcodes the RFC 8693 subject token type to urn:ietf:params:oauth:token-type:id_token in IdentityAssertionGrant.RequestJwtAuthorizationGrantAsync (subject_token_type = TokenTypeIdToken), and the public IdentityAssertionGrantIdTokenCallback returns only an ID token string. So today the flow is OIDC-ID-token-only.
RFC 8693 and the Identity Assertion Authorization Grant draft also allow SAML 2.0 assertions as the subject token. The Python SDK (PR #1721) parameterizes subject_token_type to support this. We even already declare an unused TokenTypeSaml2 constant in IdentityAssertionGrant.cs, which implies support we don't actually have.
Suggested direction
Adding SAML 2.0 support would be additive and doesn't need to block #1305:
- Either introduce a parallel subject-assertion callback (e.g. a
SubjectAssertionCallbackreturning the assertion plus its token type), or add a subject-token-type field onIdentityAssertionGrantProviderOptionsand thread it through the RFC 8693 exchange.
Until then, we should either wire up TokenTypeSaml2 or drop the unused constant so the code doesn't imply unsupported functionality.
Related: #1305
Activity
zhenyu-02 commentedon Aug 20, 2026
I would like to work on this. I plan to add an optional subject token type to
IdentityAssertionGrantProviderOptions(defaulting to the current ID token type for compatibility), thread it through the RFC 8693 exchange, and cover both ID-token and SAML 2.0 cases with mock HTTP tests.