Full Cross-Domain Access
Complete real-world scenario combining PKCE, PAR, Token Exchange, DPoP, and ID-JAG for cross-domain resource access.
Sequence Diagram — Full Cross-Domain Access
1
Generate DPoP Key Pair
Client generates an ephemeral key pair for sender-constraining all tokens in the flow.
Client App→Client App
2
Pushed Authorization Request (PAR)
Client pushes authorization parameters server-to-server, including PKCE challenge, DPoP JWK thumbprint (dpop_jkt), delegation scope, and RAR authorization_details.
Client App→IdP (Authorization Server)
3
User Authorization (PKCE + request_uri)
User is redirected with only the request_uri. IdP authenticates user and returns auth code.
Client App→IdP (Authorization Server)
4
Code Exchange with PKCE Verifier
Client redeems the authorization code with code_verifier and DPoP proof, receiving ID Token, actor_token (for delegation), and a DPoP-bound access token.
Client App→IdP (Authorization Server)
5
Delegation Token Exchange: ID Token + Actor Token → ID-JAG
Client performs delegation token exchange by sending subject_token and actor_token, requesting an Identity Assertion JWT Authorization Grant (ID-JAG) bound to the DPoP key via cnf.jkt.
Client App→IdP (Authorization Server)
6
Present JWT Grant with DPoP Proof to Authorization Server B
Client presents the DPoP-bound JWT authorization grant to Authorization Server B using jwt-dpop grant type and DPoP proof to obtain a DPoP-bound access token.
Client App→Authorization Server B
7
Access Protected Resource with DPoP
Client accesses the resource using the DPoP access token and a fresh DPoP proof.
Client App→Resource Server