[JamesDemeryNava]

JIRA Ticket:
BB2-4865

What Does This PR Do?

Adds support for the OIDC4IDA token format in the id_token of the decoded client_assertion that is posted during a CAN token request.

Note: As of August 13th, the CSPs do not support this format, so we can't test the CAN flow with the client_credentials_validation waffle switch. Once they do support this format, we can test with the waffle switch enabled, and then this PR will be published.

What Should Reviewers Watch For?

If you're reviewing this PR, please check for these things in particular:

• Any concerns on how we are returning the payload from _validate_ial_jwt?

Validation

• Go through the local CAN flow steps from this document. Make sure the client_credentials_validation waffle switch is enabled when you do this.
• Disable the client_credentials_validation waffle switch. Then, make a CAN call with the client_assertion below. Note that if you decode the client_assertion below, and then decode the id_token, you will see the OIDC4IDA token format

eyJhbGciOiJSUzM4NCIsImtpZCI6Im15LWtleS1pZC0xIiwidHlwIjoiSldUIn0.eyJpc3MiOiJpTUpxaUIzQ0ZSZmNRcnF4ZXc5dXJ1dlY4TmpEVk44V25lMGp3R1lmIiwic3ViIjoiaU1KcWlCM0NGUmZjUXJxeGV3OXVydXZWOE5qRFZOOFduZTBqd0dZZiIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC92My9vL3Rva2VuIiwianRpIjoiM2VhYTY3MTgtZjUxNC00YTE1LTk2MjMtYmE0OWMwM2FjYTJlIiwiZXhwIjoxNzg2NjMxNDEwLCJpYXQiOjE3ODY2MzExMTAsImV4dGVuc2lvbnMiOnsiY21zX3NtYXJ0Ijp7InZlcnNpb24iOiIxIiwicHVycG9zZV9vZl91c2UiOiJQQVRSUVQiLCJpZF90b2tlbiI6ImV5SmhiR2NpT2lKU1V6STFOaUlzSW10cFpDSTZJakV4WVRKa01qRmhMVEJrTUdRdE5EZGtZaTFpT1RrMExUbGlZakF4TURnM09UbGlOeUlzSW5SNWNDSTZJa3BYVkNKOS5leUpoZEY5b1lYTm9Jam9pYlhOMmRVSjVYM04wUkZWclIxOUZObUpDZG5GT1VTSXNJbUYxWkNJNld5SmliSFZsWW5WMGRHOXVMWE5oYlhCc1pTSmRMQ0poZFhSb1gzUnBiV1VpT2pFM09EUXpNRGs1TWpJc0ltVjRjQ0k2TVRjNE5ETXhNelUwTXl3aWFXRjBJam94TnpnME16QTVPVFF6TENKcGMzTWlPaUpvZEhSd2N6b3ZMM1psY21sbWFXVmtMbU5zWldGeWJXVXVZMjl0TDJsdWRHVm5jbUYwYVc5dWN5SXNJbXAwYVNJNkltTm1Nekl5WldKaUxUYzVZMkV0TkdFeU1DMWhOelExTFdGak5qVTRaRGd6T0ROa01TSXNJbk5wWkNJNkltSmtaak0xTWprMExUZzJNRGd0TkRWbFlTMWlZVEl3TFRrME5tVXhOelV5TkRKa05TSXNJbk4xWWlJNklqTndjRWd5YWt0dE9FeFZPRFpUY0RSeU1FSkJXREIxTTFkaVdEWkdTek55VTJkNFduTm9OVk40ZHlJc0luVjFhV1FpT2lJeFl6TmpZMlpqWWkweE5XUTNMVFE0TjJJdE9XVmxaQzA0T0dRd1pqZ3lZalF3WXpNaUxDSjJaWEpwWm1sbFpGOWpiR0ZwYlhNaU9uc2lkbVZ5YVdacFkyRjBhVzl1SWpwN0luUnlkWE4wWDJaeVlXMWxkMjl5YXlJNkltNXBjM1JmT0RBd1h6WXpZU0lzSW1GemMzVnlZVzVqWlY5c1pYWmxiQ0k2SW1saGJESWlmU3dpWm1GdGFXeDVYMjVoYldVaU9pSk5XVU5JUVZKVUlpd2laMmwyWlc1ZmJtRnRaU0k2SWtSQlRVOU9JaXdpYzNWbVptbDRJam9pSWl3aWJtRnRaVjlvYVhOMGIzSnBZMkZzSWpwYmV5Sm1ZVzFwYkhsZmJtRnRaU0k2SWsxWlEwaEJVbFFpTENKbmFYWmxibDl1WVcxbElqb2lSRUZOVDA0aUxDSnRhV1JrYkdWZmJtRnRaU0k2SWlJc0luTjFabVpwZUNJNklpSjlYU3dpWjJWdVpHVnlJam9pYldGc1pTSXNJbUpwY25Sb1pHRjBaU0k2SWpFNU56a3RNRGN0TWpZaUxDSmxiV0ZwYkNJNkltUnRlV05vWVhKMFFHZHRZV2xzTG1OdmJTSXNJbkJvYjI1bFgyNTFiV0psY2lJNklpc3hOakE0TWpFeE16TXhOQ0lzSW5Cb2IyNWxYMjUxYldKbGNsOW9hWE4wYjNKcFkyRnNJanBiZXlKamIzVnVkSEo1SWpvaVZWTWlMQ0ptYjNKdFlYUjBaV1FpT2lJek1EZ2dUMEZMSUZOVUxDQk5RVVJKVTA5T0xDQlhTU0ExTXpjeE1TQlZVeUlzSW14dlkyRnNhWFI1SWpvaVRVRkVTVk5QVGlJc0luQnZjM1JoYkY5amIyUmxJam9pTlRNM01URWlMQ0p5WldkcGIyNGlPaUpYU1NJc0luTjBjbVZsZEY5aFpHUnlaWE56SWpvaU16QTRJRTlCU3lCVFZDSjlYU3dpWVdSa2NtVnpjeUk2ZXlKamIzVnVkSEo1SWpvaVZWTWlMQ0ptYjNKdFlYUjBaV1FpT2lJek1EZ2dUMEZMSUZOVUxDQk5RVVJKVTA5T0xDQlhTU0ExTXpjeE1TQlZVeUlzSW14dlkyRnNhWFI1SWpvaVRVRkVTVk5QVGlJc0luQnZjM1JoYkY5amIyUmxJam9pTlRNM01URWlMQ0p5WldkcGIyNGlPaUpYU1NJc0luTjBjbVZsZEY5aFpHUnlaWE56SWpvaU16QTRJRTlCU3lCVFZDSjlMQ0poWkdSeVpYTnpYMmhwYzNSdmNtbGpZV3dpT2x0ZExDSnpjMjVmYVhScGJpSTZJaUlzSW5OemJsOXBkR2x1WDJ4aGMzUmZOQ0k2SWlJc0lteGxaMkZzWDJsa0lqb2lJbjE5LllWZzdPN21HSzhRQ1JMMUU4VHNZbndTZjJqM0F0S1ExWlR0S0tNUFVQOFE4azR6Z2dFR0hzcHB4NlVjV2lPcUtwTURCOWFXYm5qX0xWV3NBaWVPT0lnbjdPUXZFRmc5dXU5RUV2MFR4VVlIbDZ2c0EtQ0w1Z1pVVjkyZnFBVHFOQTZENzB6V2hqN1VneEZSY1VFdGYtMmkxZmVCUlRnQjRPZ1FxblJ3QjZXRFFYeEJQNzhWWjJqZm9CTGFqZVJuY05yZktJLW45ZmhKaHJwSVFiZzBRMEV1dXhDb2h6UHV4UVpmLWxKVnhZMWxmZ2s4ejc2SWRIQWRIWmtoVHBtR0QzaFg3MWg4RjNSbWVobEprSzVBMXhFZ2IzWFZFeTdQdUpmeEFzNGxBQzVKMGpDNnVzYjh5Yk5xZTRab0I0WERnRWszNmhMeU9TLVVhb1ZMOVY5U0V2QSJ9fX0.VgY9_XObYzN9b5qulw3mofy9JB4RcASaWJ9BjPaQFkRmpZSoNEIMTEhA07xTH6lavpR3oRo1umlSEdmp3e2HfoPmjF1ID8WTIp1Vmd609vdtoRhN1KSj-H7SfLK0CXxa8RpUFfvyC2q67h-kvzyAunNlQEy85kLhydEjP3ba7pdSnZ2D21UmAB7AHr9qBQvD7Yq-ETM2cBtNoSFPtQeoRpLKzPpMiWRxtRHP8FrwV0COA34sDYaJVWKnFQHYNVlyk-WUxd-AdpYbNrxAJ_MsNFen-dW0lKnmqg0_jC01O1CgMjdo2qorhIwmU1YgGY2Lxxw2pe6JdZ5Wv_EWHogBjw

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• No migrations