* feat(mcp): accept an ID-JAG as an RFC 7523 jwt-bearer grant on the gateway token endpoint (#46748)
Backport of #46748 to rc/1.107.0.
Cherry-picked from bca7650e8f (main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(sso): capture the IdP id_token on Microsoft and Google logins for oauth2_id_jag (#46747)
Backport of #46747 to rc/1.107.0.
Cherry-picked from 3501e36fa9 (main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(sso): retain the SAML assertion at login as the saml2 subject token for oauth2_id_jag (#46745)
Backport of #46745 to rc/1.107.0.
Cherry-picked from f02449ad38 (main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(proxy): keep the OIDC login refresh token as the ID-JAG subject when the SSO client is the ID-JAG client (#47004)
Backport of #47004 to rc/1.107.0.
Cherry-picked from fc484be77a (main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>