Behavior of On-Behalf-Of Token Exchange and User/Group-Based Access Rule Conditions in Okta

During the On-Behalf-Of Token exchange flow, a user's Access Token is exchanged for an Access Token granted to a Service application. When this Service application makes a request to Okta to exchange the user's token, the Access Policies/Rules for the relevant Custom Authorization Server will not take into account any User- or Group-based conditions in the rules. This means there is no way to configure the lifetimes of tokens issued to the Service Application or the scopes they can be granted based on user context.

• API Access Management
• Access Policies and Rules
• OAuth 2.0 On-Behalf-Of (OBO) Token Exchange
• API Service application
• Okta Classic Engine
• Okta Identity Engine (OIE)

How are Access Policies and Rules evaluated during On-Behalf-Of Token Exchange?

To complete the On-Behalf-Of Token exchange, the Service application will need to receive an Access Token that was granted to a specific individual user. When the user authenticates with the initial application (for example, a Native app), this application and the user will be in context during Access Policy/Rule evaluation. 

Next, the Service app makes a request to Okta to complete the On-Behalf-Of Token exchange, and the user's Access Token is then used as the subject_token. When this request occurs, the Access Policy evaluation will be based on this Service application. The original user will not be in context during this request, so Access Rules conditions that are related to the user (such as Group membership criteria) will be ignored.