feat: extra claims for rfc7523 grands

[pflipp]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

With the consent session I provide access-/id token claims which reference for example tenant-ID or group-ID of the user.
in the backend i do token introspection and based on the result i have implemented further rules for authorization (allow/deny access for specific groups) or routing (eg. route user form tenant-ID to service tenant-ID.example.org).

Now I would like to use urn:ietf:params:oauth:grant-type:jwt-bearer tokens to access the backend but the implemented rules will not work as these extra claims are not present.

Describe your ideal solution

provide a "extra_claims" field in the admin endpoint:

POST /trust/grants/jwt-bearer/issuers

{
  ....
  "subject": "bar",
  "extra_claims": {
    "my": "extra claim"
  }
}

in the authorization flow of urn:ietf:params:oauth:grant-type:jwt-bearer the access token session could be enriched with the "extra_claims" and in the end the token introspection would return them:

POST /oauth2/introspect

token=[access-token]

200 OK

{
  "sub": "bar",
  "ext": {
    "my": "extra claim"
  }
}

Workarounds or alternatives

on every request make an additional request to the login provider to ask for this information.

Version

1.11.9

Additional Context

if you think this is a reasonable feature for hydra, i would be up to contribute.

[aeneasr]

True, token exchange currently does not support additional claims! Not sure what the best approach to solve this would be here…

[rahlenjakob]

I have a use case where I want to add dynamic claim values (and keys) depending on several factors (properties sent in the initial requests, properties in the provided JWT token, etc.)

Workarounds or alternatives
on every request make an additional request to the login provider to ask for this information.

IMO the workaround aligns pretty well with the hook approach used for updating refresh token claims - having something similar here would make sense to me.

This aligns very well with #3244

[sgal]

@pflipp You can use token hook feature to add extra claims during the token exchange. See https://www.ory.sh/docs/hydra/guides/claims-at-refresh

[pflipp]

@sgal thank you for implenting #3244!

I will close this as the workaround with the refresh token hook would work for me