What might an on-behalf-of token look like?

In a previous Obtaining an on-behalf-of Authorization Token, I described a method for obtaining an on-behalf-of authorization token and some requirements for user approval/consent for such a token to be created. In this article I’d like to briefly describe what such a token could look like.

The key aspects of an on-behalf-of token are the actors involved in the delegated authorization, the relationships of those actors, the validity constraints of the issued token and the authorization conveyance enabled by the token.

Let’s go back to the use case from the previous article: Alice calls her financial institution’s customer care number in order to get help completing a transaction; say transferring funds between accounts. Alice is connected to customer care agent Bob who will help her complete the task. The customer care software Bob is using will need to obtain an on-behalf-of token so that Bob can act as Alice's fiduciary for this transaction.

If we break down the use case into it's component parts we get the following elements:

• Actor: Alice - entity delegating authority to Bob
• Actor: Bob - entity acting as the fiduciary of Alice
• Relationship: Bob as the customer care agent for Alice
• Constraints: short lived (60 secs)
• Authorization: transfer funds from Checking account to Savings account

Using a JWT based access token structure (RFC 9068) we can represent these components as follows.

{
    "iss": "https://idp.example.com/",
    "sub": "<Alice>",
    "aud":   "https://rs.example.com/",
    "exp": 1618354150,
    "iat": 1618354090,
    "jti" : "dbe39bf3a3ba4238a513f51d6e1691c4",
    "client_id": "s6BhdRkqt3",
    "authorization_details": [
        {
            "type": "funds_transfer",
            "locations": [
                "https://rs.example.com/transfer"
            ],
            "instructedAmount": {
                "currency": "EUR",
                "amount": "123.50"
            },
            "srcAccountName": "Checking",
            "srcAccount": {
                "bic":"ABCIDEFFXXX",
                "iban": "DE02100100109307118603"
            }
            "destAccountName": "Saving",
            "destAccount": {
                "bic":"ZGWEDFASEFS",
                "iban": "DE02100100109309420568"
            }
        }
    ]
    "act": {
        "sub": "<Bob>",
        "rel": "custCareAgent"
    }
}        

Note that the authorization_details claim comes from the Rich Authorization Request (RFC 9396) specification and the act claim comes from the Token Exchange (RFC 8693) specification.