Should clarify the HTTP message signature steps in 9.10 Token Exchange

[christian-posta]

For the scenario:

Agent 1 --> Agent 2 --> Resource

Agent 1 passes an Auth Token... and for Agent 2 to call resource, it needs to pass the following to Resource's Auth Server:

• resource token
• Agent 2's "upstream" token, aka the token Agent 1 passes to Agent 2.

But it's not clear how the Auth Server involved in the token exchange is supposed to verify the signature.

The upstream auth token MUST be presented via the Signature-Key header using sig=jwt;jwt="".

Which signature? The upstream jwt is signed by Agent 1 (ie, jwt.cnf is Agent 1's public key). The JWT itself is signed by the Auth Server of Agent 2.

[dickhardt]

I think this is a mistake in that version of the doc

the upstream auth token is a parameter in the call to the AS2 token endpoint -- the signature-key would be signed by the agent and include either an agent token or the jwks_uri

[christian-posta]

Excellent, that's how i implemented it in my POCs. Thanks!