IETF · May 2015
RFC 7523
M. Jones, B. Campbell, C. Mortimore
Cross-domain 'agent already has an identity assertion, needs an access token over here' is RFC 8693 then RFC 7523. Without 7523 there is no ID-JAG redemption step.
At a glance
Actors
01
RFC 7523 lets a client authenticate to an AS, or request a token, with a signed JWT assertion instead of a shared secret or an authorization code. Cross-domain 'the agent already has an identity assertion, needs an access token over here' is RFC 8693 then RFC 7523. Without 7523 there is no ID-JAG redemption step.
Agents that already have a key (SPIFFE, AAuth, private_key_jwt CIMD clients) should prefer this over a client_secret in Kubernetes.
02
The assertion issuer (often the client itself for private_key_jwt, or an IdP for JWT bearer grants) is trusted by the receiving AS. The assertion MUST be audience-restricted to that AS. A stolen assertion replayed at another AS is the mix-up analogue.
03
Client authentication: client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer and client_assertion=<jwt>. Authorization grant: grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion=<jwt>. The JWT carries iss, sub, aud (the AS), exp, jti. Short-lived. draft-ietf-oauth-rfc7523bis was in the RFC Editor queue in 2026 — watch it for nested JWT clarifications.
04
Flow 1
Client obtains a JWT authorization grant audience-restricted to this AS (from token exchange / identity chaining / XAA).
POSTs grant_type=jwt-bearer and assertion=the JWT, plus any requested resource/scope.
AS validates signature, aud, exp, and policy, then issues an access token for its RS.
05
Both: private_key_jwt is client authentication; jwt-bearer is an authorization grant. The assertion's subject is identity; the issued access token is authorization at this AS.
06
Often the step that mints the JWT grant 7523 redeems.
Profiles 8693 + 7523 for cross-domain hops.
ID-JAG is redeemed via 7523 at the resource app's AS.
CIMD forbids shared-secret client auth; public-key methods such as private_key_jwt are the intended pair.
07
If aud is the client or the RS instead of the AS, you have an ID Token shaped object. XAA's whole point is that ID-JAG aud is the resource AS, unlike an ID Token.
jti and short exp matter. Bearer assertions without PoP can be stolen in logs.
08
RFC 7523, May 2015. Stable. 7523bis in the RFC Editor queue in 2026 — watch for clarifications, do not wait to implement 7523. https://www.rfc-editor.org/rfc/rfc7523.html
draft-ietf-oauth-rfc7523bis was in the RFC Editor queue in 2026 (awaiting first editor). New implementations should watch 7523bis for clarifications, especially around nested JWT handling.