Patch 2

[jefftaylor-okta]

I've added more copy, but I need some help with the steps and Code Snippets.

[jefftaylor-okta]

@sdesen @kamronbatman Can you help add some color to the steps?

[sdesen]

Requesting App Steps

1. Store id_token
   Optionally, store refresh token. Then fetch another id_token using the refresh token.

2. Make request for ID-JAG token within lifetime of id_token
   Code Example:

   id-assertion-authz-node-example/packages/wiki0/src/server/controllers/oidc.ts

   Line 110 in 2a40682

   authGrantResponse = await requestIdJwtAuthzGrant({

3. Make request for Access Token within lifetime of ID-JAG token
   Code example:

   id-assertion-authz-node-example/packages/wiki0/src/server/controllers/oidc.ts

   Line 143 in 2a40682

   accessTokenResponse = await exchangeIdJwtAuthzGrant({

Resource App Steps:

1. Accept new request type at /token endpoint
2. Validate in exchange for Access Tokens
   Validate the scopes as the server normally would, in addition to the validation in the spec

Code example:

id-assertion-authz-node-example/packages/authorization-server/jwt-authorization-grant.js

Line 14 in 2a40682

async function jwtAuthorizationGrantHandler(ctx, next) {