Refactor token exchange configuration

Author: ctriant

docs/source/contents/conf.rst

@@ -344,7 +344,37 @@ An example::
               "client_secret_jwt",
               "private_key_jwt",
             ],
-            "revoke_refresh_on_issue": True
+            "revoke_refresh_on_issue": True,
+            "token_exchange": {
+              "subject_token_types_supported": [
+                "urn:ietf:params:oauth:token-type:access_token",
+                "urn:ietf:params:oauth:token-type:refresh_token",
+                "urn:ietf:params:oauth:token-type:id_token"
+              ],
+              "requested_token_types_supported": [
+                "urn:ietf:params:oauth:token-type:access_token",
+                "urn:ietf:params:oauth:token-type:refresh_token",
+                "urn:ietf:params:oauth:token-type:id_token"
+              ],
+              "policy": {
+                "urn:ietf:params:oauth:token-type:access_token": {
+                  "callable": "/path/to/callable",
+                  "kwargs": {
+                    "audience": ["https://example.com"],
+                    "resource": [],
+                    "scopes": ["abc", "def"]
+                  }
+                },
+                "urn:ietf:params:oauth:token-type:refresh_token": {
+                  "callable": "/path/to/callable",
+                  "kwargs": {
+                    "audience": ["https://example.com"],
+                    "resource": [],
+                    "scopes": ["abc", "def"]
+                  }
+                }
+              }
+            }
           }
         },
         "userinfo": {

src/oidcop/configure.py

@@ -564,7 +564,37 @@ def __init__(
                     "client_secret_basic",
                     "client_secret_jwt",
                     "private_key_jwt",
-                ]
+                ],
+                "token_exchange": {
+                    "subject_token_types_supported": [
+                        "urn:ietf:params:oauth:token-type:access_token",
+                        "urn:ietf:params:oauth:token-type:refresh_token",
+                        "urn:ietf:params:oauth:token-type:id_token"
+                    ],
+                    "requested_token_types_supported": [
+                        "urn:ietf:params:oauth:token-type:access_token",
+                        "urn:ietf:params:oauth:token-type:refresh_token",
+                        "urn:ietf:params:oauth:token-type:id_token"
+                    ],
+                    "policy": {
+                        "urn:ietf:params:oauth:token-type:access_token": {
+                        "callable": "/path/to/callable",
+                        "kwargs": {
+                            "audience": ["https://example.com"],
+                            "resource": [],
+                            "scopes": ["abc", "def"]
+                        }
+                        },
+                        "urn:ietf:params:oauth:token-type:refresh_token": {
+                        "callable": "/path/to/callable",
+                        "kwargs": {
+                            "audience": ["https://example.com"],
+                            "resource": [],
+                            "scopes": ["abc", "def"]
+                        }
+                        }
+                    }
+                    }
             },
         },
         "userinfo": {