Feat: ID-JAG Refreshable

[mlajkim]

Description

Athenz ID-JAGs can outlive the original IdP session, so requiring users to authenticate again frequently can be impractical. This Athenz-specific extension renews an unexpired ID-JAG using the authenticated service’s X.509 certificate.

What's done

you can now refresh the idjag, with subject_token_type=id-jag:

curl -sS -X POST "${zts_url}" \
  --cert "${cert_path}" \
  --key "${key_path}" \
  --cacert "${ca_cert}" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  --data-urlencode "requested_token_type=urn:ietf:params:oauth:token-type:id-jag" \
  --data-urlencode "subject_token_type=urn:ietf:params:oauth:token-type:id-jag" \
  --data-urlencode "subject_token=${current_id_jag}"

the original auth_time is kept when refreshing. athenz.zts.jag_token_refresh_max_timeout sets the maximum refresh window from that time (30 days by default), and the expiry still uses the shortest allowed timeout.

Contribution Checklist:

• The pull request does not introduce any breaking changes
• I have read the contribution guidelines.
• Create an issue and link to the pull request.

Attach Screenshots (Optional)

[Copilot]

⚠️ Not ready to approve

The updated test JWK setup assumes RSA keys and can throw a ClassCastException under EC-key configurations, which should be made algorithm-safe before merging.

Pull request overview

Adds support for refreshing an existing ID-JAG (Identity Assertion Grant) token via the OAuth2 token-exchange endpoint in ZTS, allowing services authenticated with mTLS to renew an ID-JAG without re-supplying the original ID token.

Changes:

• Introduces a new JAG_TOKEN_REFRESH request type in AccessTokenRequest and routes it through ZTSImpl.postAccessTokenRequest.
• Implements processJAGTokenRefreshRequest in ZTSImpl to re-mint a ZTS-signed ID-JAG while preserving the original grant (scope/claims) and enforcing mTLS service authentication and client binding.
• Extends token support utilities/tests to preserve custom claims during refresh and adds end-to-end refresh test coverage.

File summaries

File	Description
servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java	Adds the ID-JAG refresh handler and shares common JAG audience/client validation helpers.
servers/zts/src/main/java/com/yahoo/athenz/zts/token/AccessTokenRequest.java	Adds JAG_TOKEN_REFRESH and request validation/parsing for refresh semantics.
servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplAccessTokenTest.java	Adds an integration-style test for issuing and refreshing ID-JAG, plus JWK processor setup tweaks.
servers/zts/src/test/java/com/yahoo/athenz/zts/token/AccessTokenRequestTest.java	Adds unit tests verifying refresh request classification and invalid-parameter handling.
libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/OAuth2Token.java	Adds a helper to copy custom (non-standard) claims from a validated token.
libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/AccessTokenTest.java	Adds coverage to ensure custom claims copying is preserved through re-signing.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mlajkim]

• try to implement with the idtoken's refresh token
• to implement this, we must have the refresh span settable for the idjag (unlimited refresh is not feasible in security)