Commit abfa1e4

mo <mo@mokhan.ca>
2018-10-28 21:32:40
saml assertion grant exchange
main
1 parent e5ec447
Changed files (8)
doc
_includes
get-well-known-oauth-authorization-server.html
oauth-tokens-authorization-code.html
oauth-tokens-client-credentials.html
oauth-tokens-password.html
oauth-tokens-refresh-token.html
oauth-tokens-saml-assertion.html
_posts
2018-10-28-oauth-tokens.markdown
spec
documentation.rb
doc/_includes/get-well-known-oauth-authorization-server.html
@@ -34,7 +34,7 @@ Referrer-Policy: strict-origin-when-cross-origin
 Content-Type: application/json; charset=utf-8
 Etag: W/"7f1eee6ebfc3008c58d630548ed1707c"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 90ffb2db-d3dd-4b4f-a88d-d66aed613527
+X-Request-Id: 2d37359e-c49d-4371-b586-d9dcc1800681
 Transfer-Encoding: chunked
 ```
doc/_includes/oauth-tokens-authorization-code.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"authorization_code","code":"kDGDYwec5Kcax9YP8BvfT2ey"}' \
+  -d '{"grant_type":"authorization_code","code":"rUQ1YicQiRKkdSvnBgGut7U4"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NTcyNDY1MDItMTI2OC00NTcxLTljMmEtZjE0MDAyOWIwOTk3OkFmTHBiNjhUSnZUeFJqeVpOcVdFbjIxVg==" \
+  -H "Authorization: Basic ZmE4NjllODItYzVhZC00MTlhLTk1ZDItMTQ4YTVmMTQxZWQ0Ojd2c0NORGV0YThzMzZteGJvS3ozUmY4Qw==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NTcyNDY1MDItMTI2OC00NTcxLTljMmEtZjE0MDAyOWIwOTk3OkFmTHBiNjhUSnZUeFJqeVpOcVdFbjIxVg==
+Authorization: Basic ZmE4NjllODItYzVhZC00MTlhLTk1ZDItMTQ4YTVmMTQxZWQ0Ojd2c0NORGV0YThzMzZteGJvS3ozUmY4Qw==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,7 +28,7 @@ Request Body:
 ```json
 {
   "grant_type": "authorization_code",
-  "code": "kDGDYwec5Kcax9YP8BvfT2ey"
+  "code": "rUQ1YicQiRKkdSvnBgGut7U4"
 }
 ```
 
@@ -44,9 +44,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"e3141af22dad223d2e19f8393f095b30"
-Set-Cookie: _proof=10aa8b09f99ab68b49b18c784ce1ce3a; path=/; HttpOnly
-X-Request-Id: d91ea209-47bb-489a-9964-ec5ed34207c9
+Etag: W/"67c79d67b32da000687d36fde2ce5ad9"
+Set-Cookie: _proof=640e75002bff77cc4948923a5bd7abae; path=/; HttpOnly
+X-Request-Id: 5e8d9d13-a3bf-45d3-8e40-fd1d0be9faa6
 Transfer-Encoding: chunked
 ```
 
@@ -54,10 +54,10 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU2ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIwODUsImF1ZCI6IjU3MjQ2NTAyLTEyNjgtNDU3MS05YzJhLWYxNDAwMjliMDk5NyIsImp0aSI6ImEyZmEyMTAxLWE0MDMtNDNiNC1iMzE4LTJhMzZhYjU0MDFmNiIsInN1YiI6IjFiYWRkYmIwLTE3NTEtNGE3MS1iZDEyLTBhYmUxZjlhN2MyZiIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.iL3y9GMl1SWS-FN_sydZ3-wcr6_A-DQ9S2zwSoMI4UzTuOrQU3d8m6i16gGic2OIXwh69vcXHq42qlUv1m36VXnKQbAUigN4uvIrH3gyYSbo2khmz_cKIgwpGrqgfgzdHak1ZFy3-E2ZCC2tGvw01iev70NnRqtnumpR3YmZEHs21o_s_rMYWV5j66uQDXvblW2x6VPKTDeC14kHvuHJ47vP7f0SSppmGZ0zsmnW2Nja7NkkQkl5DZUWz6KRmn5JqjNHq_TZhKzNRIuPDfILZD87UMwzqswy0E15Y8vY4hmIp18jvyIUU_hJyk5W3tGWv-CYYWr-CSHUSqfxxZtyYg",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU5MTQsImlhdCI6MTU0MDc2MjMxNCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIzMTQsImF1ZCI6ImZhODY5ZTgyLWM1YWQtNDE5YS05NWQyLTE0OGE1ZjE0MWVkNCIsImp0aSI6IjY3ZmY1NjkzLWQxZmEtNDAxZS04M2E2LWQ0NWE4Y2JmMWIxYiIsInN1YiI6IjU3NmFmYTg0LTNkMDgtNDAxNi05ZDdlLTJmNzg1NDVhNzU1OSIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.B8AQ6TEejB0WgcGR5wj6UBR67-cbQ3qrP4lGRSPlzmtJYY53I0e8Zt_8MnEypbf0VOHHRuagi6OYvTjKJtCs3kTjpnHe0v0SgXzn2ZamxDgbPfRHinrYq84WyKfVXjoQfCT-S5CjXNhKDZbiCcLtminMlTEIOomUZtxVrZZNS-ifXT3ozXHCnLRIthp9DeNzDm-Fs5MFs_vtD7yHnlMFnCkvIajyB1zrhj31qqGfPkjErDJoYRr0x2-0XSGdJdsigSFXt_XtIhbOmisxwjwmLAFm41Zsld1oYPhJmyC3qg6DZ6x_zirvBn-5dJI7ti_02qXq2Ojqnf9yFu1-IDLZKg",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NDg0ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIwODUsImF1ZCI6IjU3MjQ2NTAyLTEyNjgtNDU3MS05YzJhLWYxNDAwMjliMDk5NyIsImp0aSI6ImRlNmE0N2NhLWYwZDEtNGE1ZS1hYmUxLTU4YTcyYzJlYjgyYiIsInN1YiI6IjFiYWRkYmIwLTE3NTEtNGE3MS1iZDEyLTBhYmUxZjlhN2MyZiIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.HWTcdDSYzQnjqVSSYlnA-MsNYx_w_L8d9pAoPlbYVKKjdbZbf9DD0dvSI9SSfpQb05wRBRuv4e5ihEmO-WXxk8qJDIYCC7FDRFJILE9QFQBTgeCp8uCBZzr-E-EfFwxjAi3JZvW4IXErWpklBFf0puceDTAf-Q1lHTCmAjSUOH2_8j4mnS8iHz5Ono1xMwycOeW4b3tLXLMFVRRB_Jezhc5MCbXYftiXQqRYmUDBACzPqGAzzmwbrO3wgKiHoeYzTr3CkeAI-LLKDtqzYN0DqLh5Tahff8fMJXwoWCjyJHKKgWBxn10YmY5iTiKfSa_TrvIAP4qwDUJWknuNouIz0A"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NDg3MTQsImlhdCI6MTU0MDc2MjMxNCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIzMTQsImF1ZCI6ImZhODY5ZTgyLWM1YWQtNDE5YS05NWQyLTE0OGE1ZjE0MWVkNCIsImp0aSI6ImUzMzZhODZhLWNmNzUtNDQwYi05MWYyLTczOTM0MDE2ZTY2ZSIsInN1YiI6IjU3NmFmYTg0LTNkMDgtNDAxNi05ZDdlLTJmNzg1NDVhNzU1OSIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.WuaH53015BkCfAolCNi3nzzb6wAgXAk4anAQpBBK49hYQqESxLAqwc5YoKVvULT4WC1GGxUwssWT_TaVHErBz_XwW6fqmPDDLRM_RjLDAEpWyt-hZ7c1k4LkipqhfTUB-DC6wpiIjc3TcJsc0gG-NKQvxOOPBiBAxvepWM6iXraKKB4AaJhR-lQKQo3eSGaiV0kuADVkBzohokrq0BBOtaPcS1HbRH5ECxTZkhTSRZKOitGUOtedlbkR7VRepqW9sgS-B6kDiuDNsp15HH9KxvVCXm8qCOtg7TFGjjKfnoBNEHR59pq5HcoFON8fNIsqFbpy72w6HcQPVhrM2iFiiw"
 }
 ```
doc/_includes/oauth-tokens-client-credentials.html
@@ -10,7 +10,7 @@ $ curl http://localhost:5000/oauth/tokens \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic OWVmYTNiZDYtZTFlNy00ZWJhLThlNzgtM2ZmZjg3ODc0NjFkOkF1eUtUZTNucEU0UWVRWGE2R3pSNjkyZA==" \
+  -H "Authorization: Basic MGEyNzA4ZWItZTNiMS00YWRlLTlmNzYtZTk2MjhlMjhkYTU5OlZyWVpXR2c3NzE2bjliVUo3UXZnbjVNVQ==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic OWVmYTNiZDYtZTFlNy00ZWJhLThlNzgtM2ZmZjg3ODc0NjFkOkF1eUtUZTNucEU0UWVRWGE2R3pSNjkyZA==
+Authorization: Basic MGEyNzA4ZWItZTNiMS00YWRlLTlmNzYtZTk2MjhlMjhkYTU5OlZyWVpXR2c3NzE2bjliVUo3UXZnbjVNVQ==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -43,9 +43,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"26f62103d1188c6cd4e55c26413ce241"
-Set-Cookie: _proof=c1d643d5c6a4c51f8a0ea951a32b61ea; path=/; HttpOnly
-X-Request-Id: 97b74acd-a09f-4e6b-9d56-f4a333ff9eaa
+Etag: W/"cd185f0d1286505f4a5701807ec12cd9"
+Set-Cookie: _proof=95010ca8a3a3d34dad971a0242518a1c; path=/; HttpOnly
+X-Request-Id: 6b9219d3-c58f-4e83-bc86-d2d55ebe3caa
 Transfer-Encoding: chunked
 ```
 
@@ -53,7 +53,7 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU2ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIwODUsImF1ZCI6IjllZmEzYmQ2LWUxZTctNGViYS04ZTc4LTNmZmY4Nzg3NDYxZCIsImp0aSI6ImI3YzFhMzAxLWE3NTctNDk2Yi05OGQyLTU5NjA4NzUzNDhiZCIsInN1YiI6IjllZmEzYmQ2LWUxZTctNGViYS04ZTc4LTNmZmY4Nzg3NDYxZCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.U8b6M84qfjrlYgB_3tIgFChTq27c9OIjhZuTYDDCx96n5It8QIOfls1QtRIzVK-RgavtanGMzhl1V3hWmbzgRUnr0Rz-I7zztSWICFGgMJb0O_BQO1T1q1cegy0ZEKCLL6Qa359pmcFTmBuaIWJ36U7ChQy1mYdKKbSM8fJPjjThlX-pGUF-NZNI4Z3VimeZCpbgUOXdTmTrNWMfOV5bVw5CM8Uwm6EBxvh1F0LbjYUKbtw-DyfE9duudVGrR_pJ9HxBx9mHrppTURKQKguTFlkVoj8zKEgJ2oTk51JREMofR8AUamG_9bjg8sL16gUBG6kYfRz5GQqRmhGpBfxlVg",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU5MTUsImlhdCI6MTU0MDc2MjMxNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIzMTUsImF1ZCI6IjBhMjcwOGViLWUzYjEtNGFkZS05Zjc2LWU5NjI4ZTI4ZGE1OSIsImp0aSI6ImUyMWE3NDIyLTJjOTYtNDU2OS04Yjk0LWZmMTY4ZmRjN2MyMCIsInN1YiI6IjBhMjcwOGViLWUzYjEtNGFkZS05Zjc2LWU5NjI4ZTI4ZGE1OSIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.gaGwUwMxQoWrhCVwLFVyfWEaLRrDIfUv6vvnarePDi5j0vFjw89_mH-c8SxXmaTxFai06MMrAfHynohWKO5wddkDG4s3LY_HVzYVDLbJ1LP404_HyIwpPHAI25np-RcPT_SLyquK_fN0q37Pe67YaP2EK7PqEsRU7yrDQU12erJ4jDLb_fUtJXAuIKmki7LucTiHK4gMV26rxcNRuZw1RvylfF_mEoH9JudKs6F4NMaPIqE1ZZ7sH53I6DJU0MpIFP_4LiGlPCMygJd407-bI6bQrRaiTJ25fvclOMQPc191d5PhJu2dr5eH47fPRGbTSGF4CWj-TOBS-BYmEvAnDw",
   "token_type": "Bearer",
   "expires_in": 3600
 }
doc/_includes/oauth-tokens-password.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"password","username":"odette@oconnellarmstrong.name","password":"BWW06lYVmM0Nnyw"}' \
+  -d '{"grant_type":"password","username":"florrie_macejkovic@mrazmayert.com","password":"4IegTCznq0"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NDRjNjllMTEtOTI4Ni00MDExLThmMzQtYzA2MDNiZDFmMmJhOnpqaTE5eG5RWlVvSkJvRlpSdHNrb2luNQ==" \
+  -H "Authorization: Basic M2Y3OTBlMmMtYTE2ZC00NGNkLWE0NDAtNDQ1ODZjNWQ4OTI0OkhaNnJ2MkE4aHBnNzRNRndSamk3c2N5Ng==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NDRjNjllMTEtOTI4Ni00MDExLThmMzQtYzA2MDNiZDFmMmJhOnpqaTE5eG5RWlVvSkJvRlpSdHNrb2luNQ==
+Authorization: Basic M2Y3OTBlMmMtYTE2ZC00NGNkLWE0NDAtNDQ1ODZjNWQ4OTI0OkhaNnJ2MkE4aHBnNzRNRndSamk3c2N5Ng==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,8 +28,8 @@ Request Body:
 ```json
 {
   "grant_type": "password",
-  "username": "odette@oconnellarmstrong.name",
-  "password": "BWW06lYVmM0Nnyw"
+  "username": "florrie_macejkovic@mrazmayert.com",
+  "password": "4IegTCznq0"
 }
 ```
 
@@ -45,9 +45,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"0c890d3506fb37150a2369c1b00f00a5"
-Set-Cookie: _proof=53ff34b48c7595629b3cd79931667c34; path=/; HttpOnly
-X-Request-Id: 48436dea-3a50-4dfd-992b-adb697302a4b
+Etag: W/"190602448f7d729c8572c14304839355"
+Set-Cookie: _proof=cdb9559660eb3d8729128eed7311795d; path=/; HttpOnly
+X-Request-Id: 660df46b-8d70-4ba7-995d-b0ad0e6f060b
 Transfer-Encoding: chunked
 ```
 
@@ -55,10 +55,10 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU2ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIwODUsImF1ZCI6IjQ0YzY5ZTExLTkyODYtNDAxMS04ZjM0LWMwNjAzYmQxZjJiYSIsImp0aSI6IjUxYjkyNTE4LWE4MTUtNGQ0Ni1hMjVkLWQzY2Y3NDM5ODNiZCIsInN1YiI6ImJjMTYxODEyLWJiYTItNDc1Ni05MjEyLTA3MjZjNWY3ZDMxNyIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.ifScI9Sz25Kn87yEAEG3BBLiPEGtxHoQlw3Ik561hybviQDC9pCvYwVQZM9Cg28ZzGVYc_YfCpc9CwlMfFoEUt-o0Oz92blMIYogNUv8_4FOvqNwuu7nwnu1rcolxfMALlF1BHVilQakBRjFJouCiFAPgUHzu4m1oYn2-_AKcgtWUxqxZWPf55SKrjTyo5m2ho83TTJNDVp_wxxiqdP_yZAzC8I4lmJO1sSDJ0ybul5GZ0o_33JGRUiC0eqARjRVd3vzmQNVeL--a3CEjHM2KPcYnDvU3VrPp-sPOb055bDVB__BNu_q3wGyNn7Ub9vhVgjWXmOylmPVbc0IneqLXg",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU5MTUsImlhdCI6MTU0MDc2MjMxNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIzMTUsImF1ZCI6IjNmNzkwZTJjLWExNmQtNDRjZC1hNDQwLTQ0NTg2YzVkODkyNCIsImp0aSI6ImY0NTliNmMzLTkyODYtNDRiNS1iYmE2LTljNjFhMzRhZjE1ZiIsInN1YiI6IjRmMDUyM2JlLThjYjQtNDEyNC04ZmE4LWVlMGZiOWRkYjlkMCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.gkQipJzzkFVHewGbE-D4rdswU8hr5OXEl9N8-5B2XFksSLcYllOgXAl-mFjctaxDc5CdbbMthmdofeE-7PUbdLfZFs1Z0oFUdrFObu1rg7bhlnsOn9L6rAk3bp4vcLixL77pu8hT4JMXKTMkT5ZX8v_gg_rkn-QUL9NKPzEn3jv9uhJYSkprXxvNA9xi2lxX8Fekdv4kDoOhc1MQXzDL1SvvbiLrR6x1DqAEnxh2elMtWbpun4Bi1RGLNAtq89FrlU1USb69WPv0P-9xjLksjUPlpUR9B8SvGli5UMOxlQk_dMwLkF9dA-w0o3ma-vRlQJseShhR9BvEL8xCUTpgKw",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NDg0ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIwODUsImF1ZCI6IjQ0YzY5ZTExLTkyODYtNDAxMS04ZjM0LWMwNjAzYmQxZjJiYSIsImp0aSI6IjAwNTVlZTFjLTVmYjktNDhjYS05OGMzLWZiNTNlMDhkN2U1MiIsInN1YiI6ImJjMTYxODEyLWJiYTItNDc1Ni05MjEyLTA3MjZjNWY3ZDMxNyIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.fMwFZyZASvcdCWxZJCLaT348FmL7qjPld0FHnS0HQP4jlh-dlsXqAlv50wU8Aha1aLXqnMSNLOS_-PK_IArUjyXT_HWR1qI5aEBh3oGe_fS8t9WhIHXDKSuqdiD3Kj7QyPYEAYb2PgJNKxYSxjScTWqFqBBzlSjyNh5Za9INXOQruzhbrvzsWq0E-iPnN5bdaCniSkSAnlkaBabS8rTFgWPEr5UFW2O-LGtCLnJMu9zAjnI5ayMnrKENWCp9D-257lMoaocuMakistTsOttSY0mIaNp2ttQZDs7lEYjj1UJYE3-P6SBVkLaOTnZVYPs5yglrLGmg21J5J1zeZUtfHg"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NDg3MTUsImlhdCI6MTU0MDc2MjMxNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjIzMTUsImF1ZCI6IjNmNzkwZTJjLWExNmQtNDRjZC1hNDQwLTQ0NTg2YzVkODkyNCIsImp0aSI6IjA2MTcxNjQwLTllOGItNDE3Yy1hZDY5LWJhMjI1YWE1N2U3NiIsInN1YiI6IjRmMDUyM2JlLThjYjQtNDEyNC04ZmE4LWVlMGZiOWRkYjlkMCIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.IhaG-exXBF8TwKbtpJUiQ8BCIpcu9a4Wpq8EkIQ4r1iYc3N2PPiTYoO7otr8zzT0illEwXp8Xhyo3X-aFXbOi3_bVXPKJYJCfSG_GRV6L7As79r7MGmdNZN5s3YCSmWYfAT08lg13W93spiwJQv5iE64AY-ZvARMQebpu5raEFhGD8VbleknJyIPWlQaBGayadYkoFkFdVpX1n5imORSdavSfCX_FomXNgA9BQfvGHy5FyhM3RSNddgbwEW0q9l7H9wEYksj4hW28oHBmHbWZZ0uP-n-ls2MGPn3lWDMXxlLNROL52Kl8QLUtmyzet8_7HnmBROS0bh1Wogc969OYg"
 }
 ```
doc/_includes/oauth-tokens-refresh-token.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU2ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2MjA4NSwiYXVkIjoiZmUyZjU0NzEtM2U4Ny00MDFmLThlN2ItNmMzZjBiNzVlMGU5IiwianRpIjoiMDY0YjZlZjgtNmM5NC00N2RlLThiOWMtYzhjNTE1Njk4NTEzIiwic3ViIjoiNWMyZDNiNmEtZmZhZC00ZTBiLWJmYmYtZGRkZThhOWIwNWE2IiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.lhEstYYI7U_71EXFv6FP5x1RsdmGcAVr-IG_oo4kIG-pTJuhWjYOaFpHKytgkPTsl91_yjM62XDNDBEFmuoypL20TN1m3WjK9XUwfUW__Bu9lfN5TNoQw8pIla31PeVjjvwYDQCkCq73z6nL5Q6zkwfUpJPrrhWq4DvRRSo35E813vnpUBD0YGZkSNYmVpiRl7v-_mNxsLgV5OQuqJOCl6XCBt9gFmm9-QBj77LPQakgHaPH78dOqqeZMZmNmj_vrcRJ0nnpP5sUXux1kqeR7AecPcoBOtLFYJt8u76zhAByXWE1kdeKSROdxxjr-BIDpV6GLW2RC_J_SwMMSwdCqg"}' \
+  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU5MTUsImlhdCI6MTU0MDc2MjMxNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2MjMxNSwiYXVkIjoiZTBjNDczM2UtNDAzZi00NzUwLTk5NDctOTQ3YzUyNDA2Y2JlIiwianRpIjoiNzgyN2YzNmQtNmM5OS00NGNhLTg1OTItMzdiODBlNGRlNGI4Iiwic3ViIjoiZjkxOGUzNzgtYThkNS00YjcyLTgzMjctNjNlYzI3MmFiZmFkIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.MTf7CbeGTU6aqCmkDymlzxqLTWRRkTS0fkJh0qqkl8Giu51OO8FkxkKqVPmPlQsK6bFhJWaGt6pYc400pFQevg7acvsjE_eySzA6C2tT9_x1bqPVzedj6tysInroPA5KvRPlMijbG7XzsgPOJPsJbVlPwA5CspGHzENOIkCyxIeVu-myGOmGrwEXiz0zGXfSN9T1bw68dHpXdQ8FLIA9pIwBPq8tFqtyP0JDwGj4Aa0hImyYJBLbEfJVkd09UU63h3oZFkRjaVLuRjtbZAEcOrmwmcSoBzSxQDSAaayu2Famd1MSobwAQFvdlV1E4lxSsrzbxb59ZO80fx48sCgcSA"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic ZmUyZjU0NzEtM2U4Ny00MDFmLThlN2ItNmMzZjBiNzVlMGU5Ok14cjM3OGtuMlVMUDZGdk5KNGhWQnBXWA==" \
+  -H "Authorization: Basic ZTBjNDczM2UtNDAzZi00NzUwLTk5NDctOTQ3YzUyNDA2Y2JlOnNoZ1pNUFoyZkVxM1VNaVoyQWNGYmJXUw==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic ZmUyZjU0NzEtM2U4Ny00MDFmLThlN2ItNmMzZjBiNzVlMGU5Ok14cjM3OGtuMlVMUDZGdk5KNGhWQnBXWA==
+Authorization: Basic ZTBjNDczM2UtNDAzZi00NzUwLTk5NDctOTQ3YzUyNDA2Y2JlOnNoZ1pNUFoyZkVxM1VNaVoyQWNGYmJXUw==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,7 +28,7 @@ Request Body:
 ```json
 {
   "grant_type": "refresh_token",
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU2ODUsImlhdCI6MTU0MDc2MjA4NSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2MjA4NSwiYXVkIjoiZmUyZjU0NzEtM2U4Ny00MDFmLThlN2ItNmMzZjBiNzVlMGU5IiwianRpIjoiMDY0YjZlZjgtNmM5NC00N2RlLThiOWMtYzhjNTE1Njk4NTEzIiwic3ViIjoiNWMyZDNiNmEtZmZhZC00ZTBiLWJmYmYtZGRkZThhOWIwNWE2IiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.lhEstYYI7U_71EXFv6FP5x1RsdmGcAVr-IG_oo4kIG-pTJuhWjYOaFpHKytgkPTsl91_yjM62XDNDBEFmuoypL20TN1m3WjK9XUwfUW__Bu9lfN5TNoQw8pIla31PeVjjvwYDQCkCq73z6nL5Q6zkwfUpJPrrhWq4DvRRSo35E813vnpUBD0YGZkSNYmVpiRl7v-_mNxsLgV5OQuqJOCl6XCBt9gFmm9-QBj77LPQakgHaPH78dOqqeZMZmNmj_vrcRJ0nnpP5sUXux1kqeR7AecPcoBOtLFYJt8u76zhAByXWE1kdeKSROdxxjr-BIDpV6GLW2RC_J_SwMMSwdCqg"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjU5MTUsImlhdCI6MTU0MDc2MjMxNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2MjMxNSwiYXVkIjoiZTBjNDczM2UtNDAzZi00NzUwLTk5NDctOTQ3YzUyNDA2Y2JlIiwianRpIjoiNzgyN2YzNmQtNmM5OS00NGNhLTg1OTItMzdiODBlNGRlNGI4Iiwic3ViIjoiZjkxOGUzNzgtYThkNS00YjcyLTgzMjctNjNlYzI3MmFiZmFkIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.MTf7CbeGTU6aqCmkDymlzxqLTWRRkTS0fkJh0qqkl8Giu51OO8FkxkKqVPmPlQsK6bFhJWaGt6pYc400pFQevg7acvsjE_eySzA6C2tT9_x1bqPVzedj6tysInroPA5KvRPlMijbG7XzsgPOJPsJbVlPwA5CspGHzENOIkCyxIeVu-myGOmGrwEXiz0zGXfSN9T1bw68dHpXdQ8FLIA9pIwBPq8tFqtyP0JDwGj4Aa0hImyYJBLbEfJVkd09UU63h3oZFkRjaVLuRjtbZAEcOrmwmcSoBzSxQDSAaayu2Famd1MSobwAQFvdlV1E4lxSsrzbxb59ZO80fx48sCgcSA"
 }
 ```
 
@@ -44,8 +44,8 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Set-Cookie: _proof=4afe95c552eabd451589aa9246c59e46; path=/; HttpOnly
-X-Request-Id: 98c00a3a-818f-42da-a299-7eb65186774e
+Set-Cookie: _proof=011d82b831995a0bb05572bece8365e8; path=/; HttpOnly
+X-Request-Id: 2ba9c419-c283-4f99-afb2-5f011a4275b1
 Transfer-Encoding: chunked
 ```
doc/_includes/oauth-tokens-saml-assertion.html
@@ -0,0 +1,60 @@
+
+#### POST http://localhost:5000/oauth/tokens
+
+Example curl request:
+
+```bash
+$ curl http://localhost:5000/oauth/tokens \
+  -X POST \
+  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","assertion":"PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il81NTEwMjMzYy02YmVkLTRhZWItYTY2OC01MjZlNWQ3Zjg1YzQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMTozMTo1NVoiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjXzU1MTAyMzNjLTZiZWQtNGFlYi1hNjY4LTUyNmU1ZDdmODVjNCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPm9jVTRoNnZDRk96QzFPM0lubm9NeXZwd1NOVWRpUXNaK2h3UFBxaHNMRzQ9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPnNYS1REbC9oOU5WU1JXV3lPMFRYZExlVytoQWxma1lEWU1FWGFzWm1ySm5lblRHQ0ZSMHc1T2ZadFFPSjVhQWNTeEx5N1lyM3kwWVQ5MTNGNEx0QlUyQVhxYnRVby9EbW1WRno2K25RS0NDRjM1SHF3RVkwb1h5d3RuaFVyYXFxeHEvWWU4K3lVRWNZbUxQSmpKcklMOHdzbFZHUTdrSk9QOTN3bEkvR3kxNW5INlJyVkhDZVB4SHd2ZDVqS044SXRpaGJvWm5nOWtScEozamg4MXBwTGdYR29CY0UvdUxEVGY0Y0UrRWZPVFZrRjZUTjZzQkY0Qm5zcldBUitPcUR4OHY3TU9jbkNLSlBuNGt1dStCYWFIS2g2UmJ2ZDZwWmM2Wk1jaGx2QVdvY3RNK2ZkS2JwaG9JYW4rdDNPMGo3VnN0dlQ5OEJ2TDZ0ZzZFaXZFT21kUT09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpFek1UVXpXaGNOTVRneE1USTNNakV6TVRVeldqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURSM1daQk1OVkh1b2dBNFZuZC9aSGUrVktUYVpHLzdkSzR0UFZud1F1NUowa1lQRUJabzVacFQzeFpDaG5SaUYybVVPb0krWDdld1ZCMEFBWWMwc2s4VTdEeGVjeDRnSzdxdjQzT3hGaWNoZlRtT01rTFdKZS9YczkvS2xuRTIxNkZMS1VrcTJ0RzVYKzhJSnFZdWQ2RVJ4SjhuVnhJUEh0WUFFcW5OMHZLUVp5UmduRzFNcW14ZUdqQnhSL1JmKzI0ZEMrOS9kT2Vza0U1V2JlZm1WQVN3eW1HN3NkS29ieGQ4YUgwcC9sOUFYZjdJcGU1SGxTM3J1bGJpcVNlam9GTmdYWnJ5bHpSZ0c0Nnc2MTFkQkhzcE5NcXRCSTlwK3dBNEF0UVlOOEh0K0V5NFFyL1FHYWkvZXRQVUhTMUs5VEExYmRLazRBSnNqdVNUZVFRSUN5YkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQU1WTzVERC9ZV0EzOExDK0F6d2Z3RHFLN0VCcDFpVkhvRVdJajAxUkZacHdXKy80SmNkMUdmeGtHaGJWRldldmI4ZFduNGZXOVBzZEt6RG12MjJ0ZkFTT0RDT2dTaTdveHFoRzZNUnFRaE53QVdIazBjalBaV2N3b1lOL0dMU1JPYVRnOEtOZllxODBUNCtQc0tCT1A2NXpLZ1hPM2ZPUmNldFJUZzFPS2tMcWJDWU9zbmlrRVprcUt1YjFyQUdoMlVsdVNUSWg0eXJCOTRqZ2NIRzdXUzdMMTFKTG1PeXJhTDFNSks0a01pOUR5Q2dJNkJNUjVwRVNsQlZTRzNEU1hMWUkzajkwazBoQlk1WHczYXltdGtWZHgvSDFGK1lEdGZmMStCcXRxZUxseUViVHgxR0w2QVJtdEVTRFVyK3VkcjVTWHF6VHRRbTFhZXJEQVVaK2hNRT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPm5lb21pX2dsb3ZlckB0cmFudG93YmVkbmFyLmluZm88L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il82ZTFlOTQ4ZS1jN2ZiLTQzNjAtYTdhNC1kYjFjYzQwOWNjMjciIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOFQyMTozNjo1NVoiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOFQyMTozMTo1NVoiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMDozMTo1NVoiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjhUMjE6MzE6NTVaIiBTZXNzaW9uSW5kZXg9Il81NTEwMjMzYy02YmVkLTRhZWItYTY2OC01MjZlNWQ3Zjg1YzQiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPjFhOTZhMjlmLWY1OWUtNGEzOS1hM2QwLTBmMjJkM2RkOGViZjwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPm5lb21pX2dsb3ZlckB0cmFudG93YmVkbmFyLmluZm88L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjggMjE6MzE6NTUgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"}' \
+  -H "Accept: application/json" \
+  -H "Content-Type: application/json" \
+  -H "User-Agent: net/hippie 0.1.9" \
+  -H "Authorization: Basic OGE3ZDQ4MDEtMjlkMi00MDYzLTk3NmQtZmE0MDhiMDI4ZThjOjZxVkhTZXlkZlhGc2tuTTU4RUd5NDNNRA==" \
+  -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
+```
+Request Headers:
+
+```text
+Accept: application/json
+Content-Type: application/json
+User-Agent: net/hippie 0.1.9
+Authorization: Basic OGE3ZDQ4MDEtMjlkMi00MDYzLTk3NmQtZmE0MDhiMDI4ZThjOjZxVkhTZXlkZlhGc2tuTTU4RUd5NDNNRA==
+Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+```
+
+
+Request Body:
+```json
+{
+  "grant_type": "urn:ietf:params:oauth:grant-type:saml2-bearer",
+  "assertion": "PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il81NTEwMjMzYy02YmVkLTRhZWItYTY2OC01MjZlNWQ3Zjg1YzQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMTozMTo1NVoiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjXzU1MTAyMzNjLTZiZWQtNGFlYi1hNjY4LTUyNmU1ZDdmODVjNCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPm9jVTRoNnZDRk96QzFPM0lubm9NeXZwd1NOVWRpUXNaK2h3UFBxaHNMRzQ9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPnNYS1REbC9oOU5WU1JXV3lPMFRYZExlVytoQWxma1lEWU1FWGFzWm1ySm5lblRHQ0ZSMHc1T2ZadFFPSjVhQWNTeEx5N1lyM3kwWVQ5MTNGNEx0QlUyQVhxYnRVby9EbW1WRno2K25RS0NDRjM1SHF3RVkwb1h5d3RuaFVyYXFxeHEvWWU4K3lVRWNZbUxQSmpKcklMOHdzbFZHUTdrSk9QOTN3bEkvR3kxNW5INlJyVkhDZVB4SHd2ZDVqS044SXRpaGJvWm5nOWtScEozamg4MXBwTGdYR29CY0UvdUxEVGY0Y0UrRWZPVFZrRjZUTjZzQkY0Qm5zcldBUitPcUR4OHY3TU9jbkNLSlBuNGt1dStCYWFIS2g2UmJ2ZDZwWmM2Wk1jaGx2QVdvY3RNK2ZkS2JwaG9JYW4rdDNPMGo3VnN0dlQ5OEJ2TDZ0ZzZFaXZFT21kUT09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpFek1UVXpXaGNOTVRneE1USTNNakV6TVRVeldqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURSM1daQk1OVkh1b2dBNFZuZC9aSGUrVktUYVpHLzdkSzR0UFZud1F1NUowa1lQRUJabzVacFQzeFpDaG5SaUYybVVPb0krWDdld1ZCMEFBWWMwc2s4VTdEeGVjeDRnSzdxdjQzT3hGaWNoZlRtT01rTFdKZS9YczkvS2xuRTIxNkZMS1VrcTJ0RzVYKzhJSnFZdWQ2RVJ4SjhuVnhJUEh0WUFFcW5OMHZLUVp5UmduRzFNcW14ZUdqQnhSL1JmKzI0ZEMrOS9kT2Vza0U1V2JlZm1WQVN3eW1HN3NkS29ieGQ4YUgwcC9sOUFYZjdJcGU1SGxTM3J1bGJpcVNlam9GTmdYWnJ5bHpSZ0c0Nnc2MTFkQkhzcE5NcXRCSTlwK3dBNEF0UVlOOEh0K0V5NFFyL1FHYWkvZXRQVUhTMUs5VEExYmRLazRBSnNqdVNUZVFRSUN5YkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQU1WTzVERC9ZV0EzOExDK0F6d2Z3RHFLN0VCcDFpVkhvRVdJajAxUkZacHdXKy80SmNkMUdmeGtHaGJWRldldmI4ZFduNGZXOVBzZEt6RG12MjJ0ZkFTT0RDT2dTaTdveHFoRzZNUnFRaE53QVdIazBjalBaV2N3b1lOL0dMU1JPYVRnOEtOZllxODBUNCtQc0tCT1A2NXpLZ1hPM2ZPUmNldFJUZzFPS2tMcWJDWU9zbmlrRVprcUt1YjFyQUdoMlVsdVNUSWg0eXJCOTRqZ2NIRzdXUzdMMTFKTG1PeXJhTDFNSks0a01pOUR5Q2dJNkJNUjVwRVNsQlZTRzNEU1hMWUkzajkwazBoQlk1WHczYXltdGtWZHgvSDFGK1lEdGZmMStCcXRxZUxseUViVHgxR0w2QVJtdEVTRFVyK3VkcjVTWHF6VHRRbTFhZXJEQVVaK2hNRT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPm5lb21pX2dsb3ZlckB0cmFudG93YmVkbmFyLmluZm88L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il82ZTFlOTQ4ZS1jN2ZiLTQzNjAtYTdhNC1kYjFjYzQwOWNjMjciIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOFQyMTozNjo1NVoiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOFQyMTozMTo1NVoiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMDozMTo1NVoiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjhUMjE6MzE6NTVaIiBTZXNzaW9uSW5kZXg9Il81NTEwMjMzYy02YmVkLTRhZWItYTY2OC01MjZlNWQ3Zjg1YzQiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPjFhOTZhMjlmLWY1OWUtNGEzOS1hM2QwLTBmMjJkM2RkOGViZjwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPm5lb21pX2dsb3ZlckB0cmFudG93YmVkbmFyLmluZm88L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjggMjE6MzE6NTUgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"
+}
+```
+
+Response Headers:
+
+```text
+X-Frame-Options: SAMEORIGIN
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+X-Download-Options: noopen
+X-Permitted-Cross-Domain-Policies: none
+Referrer-Policy: strict-origin-when-cross-origin
+Cache-Control: private, no-store
+Pragma: no-cache
+Content-Type: application/json; charset=utf-8
+Set-Cookie: _proof=393904e35f629c720dfda750ba627569; path=/; HttpOnly
+X-Request-Id: df3be698-a992-40cc-b95e-b7291462313a
+Transfer-Encoding: chunked
+```
+
+
+Response Body:
+```json
+{
+  "error": "invalid_request"
+}
+```
+
+
doc/_posts/2018-10-28-oauth-tokens.markdown
@@ -81,6 +81,12 @@ The Tokens endpoint adheres to [RFC-6749](https://tools.ietf.org/html/rfc6749).
 
 {% include oauth-tokens-client-credentials.html %}
 
+## SAML Assertion Grant
+
+[RFC-7522](https://tools.ietf.org/html/rfc7522)
+
+{% include oauth-tokens-saml-assertion.html %}
+
 ## Refreshing an Access Token
 
 [Section 6](https://tools.ietf.org/html/rfc6749#section-6)
spec/documentation.rb
@@ -69,6 +69,17 @@ RSpec.describe "documentation" do
     end
   end
 
+  specify do
+    headers = { 'Authorization' => ActionController::HttpAuthentication::Basic.encode_credentials(client.to_param, client.password) }
+    saml_request = instance_double(Saml::Kit::AuthenticationRequest, id: Xml::Kit::Id.generate, issuer: Saml::Kit.configuration.entity_id, trusted?: true)
+    saml = Saml::Kit::Assertion.build_xml(user, saml_request)
+    body = { grant_type: 'urn:ietf:params:oauth:grant-type:saml2-bearer', assertion: Base64.urlsafe_encode64(saml) }
+    VCR.use_cassette("oauth-tokens-saml-assertion") do
+      response = hippie.post("#{scheme}://#{host}/oauth/tokens", body: body, headers: headers)
+      expect(response.code).to eql('200')
+    end
+  end
+
   specify do
     headers = { 'Authorization' => ActionController::HttpAuthentication::Basic.encode_credentials(client.to_param, client.password) }
     refresh_token = create(:refresh_token, audience: client)