Authentication tokens

Bearer token (JWT: RFC 7516) issued by the identity partner (IdP) to attest a user's identity.

{
  "aud": string,
  "email": string,
  "exp": string,
  "iat": string,
  "iss": string,
  "google_email": string,
  ...
}

KACLS authentication token for delegate

The authentication token contains a JSON Web Token (JWT) (JWT: RFC 7516) that is a bearer authentication token.

Sometimes a user is not able to authenticate on a client directly. In these cases the user can delegate their access to a specific resource to that client. This is achieved through issuing a new delegated authentication token that limits the scope of the original authentication token.

The delegated authentication token is similar to the ordinary authentication token with one additional claim:

The resource_name claim in the authentication token is, in a delegation context, used for identifying the object encrypted by the Data Encryption Key (DEK) for which the delegation is valid.

The token is issued by the Key Access Control List Service (KACLS) using the Delegate call. It may be either self-signed JWTs that KACLS is able to validate, or KACLS may use any other IdP to do that, through a trusted call.

In order for the delegated authentication token to be considered valid, a delegated authorization token must be provided for the same operation. The delegated authorization token is similar to the ordinary authorization token, but contains the additional claim delegated_to. The values of the delegated_to and resource_name claims must match the values in the delegated authentication token.

We recommend that you set a lifetime value of 15 minutes for the delegated authentication tokens to avoid potential reuse in case of leakage.

{
  "email": string,
  "iss": string,
  "aud": string,
  "exp": string,
  "iat": string,
  "google_email": string,
  "delegated_to": string,
  "resource_name": string
  ...
}

KACLS authentication token for PrivilegedUnwrap

Bearer token (JWT: RFC 7516) issued by the identity partner (IdP) to attest a user's identity.

This is only used on PrivilegedUnwrap. During PrivilegedUnwrap, if a KACLS JWT is used in place of an IDP authentication token, the recipient KACLS must first fetch the JWKS of the issuer, then verify the token signature, before checking the claims.

{
  "aud": string,
  "exp": string,
  "iat": string,
  "iss": string,
  "kacls_url": string,
  "resource_name": string
  ...
}