Identity Assertion Authorization Grant (ID-JAG)
The Identity Assertion Authorization Grant (ID-JAG), defined by the IETF draft draft-ietf-oauth-identity-assertion-authz-grant, is a JWT that carries a user's identity from an identity provider to another authorization server, so the second server can issue an access token without its own sign-in step. When used with the Model Context Protocol, this pattern is called Enterprise-Managed Authorization (EMA); see the EMA extension and Enterprise-Managed Authorization for MCP.
Two Roles
ThunderID plays both roles in the ID-JAG exchange, and both applications and agents can take part in either one.
ThunderID issues ID-JAGs for your applications and agents to present to an external authorization server:
ThunderID accepts ID-JAGs minted by an external identity provider:
- To issue ID-JAGs from your own applications or agents, see Issue Identity Assertions.
- To accept ID-JAGs from an external identity provider, for an application or an agent, see Accept Identity Assertions.
Notes
Setting oauth.id_jag.issuance.enabled or oauth.id_jag.acceptance.enabled to false turns that role off for the whole deployment, whatever the application or trusted issuer settings say. Both are on by default. The well-known documents list urn:ietf:params:oauth:grant-type:token-exchange in grant_types_supported while oauth.allowed_grant_types allows it. They list urn:ietf:params:oauth:grant-type:jwt-bearer, and with it the ID-JAG grant profile urn:ietf:params:oauth:grant-profile:id-jag in authorization_grant_profiles_supported, while it is allowed and acceptance is on. Configuration, including trusted issuers and allowed audiences, is exchanged out of band. Scope semantics differ per leg: issuance passes the requested scope through verbatim, while acceptance intersects it with the assertion's own scope. Neither leg issues a refresh token.
