Expand description
Ephemeral Non-Human Identity (NHI) validation — brief Module D.
Short-lived JWTs (EdDSA primary, HS256 for dev/IdP-shared-secret setups)
with a hard 15-minute TTL cap, plus cryptographically enforced scope
inheritance for parent→child agent delegation: a child token carries its
parent’s token; the chain is signature-verified link by link and every
link’s scopes must be a subset of its parent’s, with child.exp ≤ parent.exp and bounded chain depth.
Adversarial coverage (tests): alg=none, algorithm confusion (HS256
header against an Ed25519 key), expired / not-yet-valid, oversized TTL,
scope escalation at any link, truncated & tampered tokens, unknown kid.
Re-exports§
pub use claims::ActorClaim;pub use claims::Audience;pub use claims::NhiClaims;pub use claims::MAX_TTL_SECS;pub use exchange::build_exchanged_claims;pub use exchange::build_exchanged_claims_with_actor;pub use exchange::check_exchanged_revocation;pub use exchange::scope_intersection;pub use exchange::verify_exchanged_token;pub use exchange::ExchangeActor;pub use exchange::ExchangeError;pub use exchange::ExchangeParams;pub use exchange::ExchangedClaims;pub use exchange::ExchangedValidation;pub use exchange::TokenExchangeRequest;pub use exchange::TokenExchangeResponse;pub use exchange::TOKEN_EXCHANGE_GRANT_TYPE;pub use revocation::InMemoryRevocationStore;pub use revocation::RevocationHealth;pub use revocation::RevocationIdentity;pub use revocation::RevocationStore;pub use revocation::RevokeOutcome;pub use revocation::RevokedBy;pub use validator::IdentityError;pub use validator::IdentityValidator;pub use validator::KeyMaterial;pub use validator::ValidatedIdentity;pub use workload::CfInstanceIdentity;pub use workload::VerifiedAssertion;pub use workload::WorkloadError;pub use workload::WorkloadTrust;pub use workload::JWT_BEARER_GRANT_TYPE;pub use workload::MAX_ASSERTION_LIFETIME_S;
Modules§
- claims
- NHI JWT claims.
- exchange
- RFC 8693 token exchange: exchange an inbound NHI token for a backend-scoped token with narrowed scopes.
- revocation
- JTI-based token revocation.
- validator
- Token validation and delegation-chain verification.
- workload
- Platform workload identity: RFC 7523 JWT-bearer assertions signed with a Cloud Foundry instance identity certificate.