Exchange
auth
Exchange
AuthBridge: exchange an upstream IdP token for a scoped CauseLoop JWT.
Deny-by-default. Verification is real, not stubbed:
- The configured identity provider (
build_provider()) verifiessubject_tokenviaprovider.verify()(signature + issuer + audience/client_id, returning normalized claims or None). A failed verification is a 401. resolve_admissiondecides admit/deny against durable provisioning state (existing membership, pending invitation, or domain-JIT only when explicitly enabled). An unprovisioned identity is denied: we write anauth.login.deniedaudit event and return 403 — we never JIT-create a user as a side effect of exchange.- On admit we load the resolved workspace, mint a scoped token via
sign_access_token (scopes derive from PERMISSIONS), and write an
auth.login.admittedaudit event.
Dev fallback: when no provider is configured and ENVIRONMENT != “production” we preserve the legacy seed-user behavior so local/mock dev keeps working (this path does NOT run admission). When no provider is configured and ENVIRONMENT == “production” we refuse (503). (identity-architecture.md §3.1 token-exchange grant)
POST
Exchange
Body
application/json