Make token.JWTToken use RFC9068 as model for payload.

[rohe]

The class JWTToken was just assuming the payload to be a dict not following any specific format.
Changed the class to use RFC9068 as model for the payload.

[peppelinux]

is the subject of the access token the RP or the user?

[c00kiemon5ter]

are you asking what the sub refers to?
or, what the groups refer to?

In both cases it is the user:

• the user has the sub identifier
• the user is a member of the presented groups

Reference: https://www.rfc-editor.org/rfc/rfc7643.html#page-23

   groups
      A list of groups to which the user belongs, either through direct
      membership, through nested groups, or dynamically calculated.  The
      values are meant to enable expression of common group-based or
      role-based access control models, although no explicit
      authorization model is defined.  It is intended that the semantics
      of group membership and any behavior or authorization granted as a
      result of membership are defined by the service provider.  The
      canonical types "direct" and "indirect" are defined to describe
      how the group membership was derived.  Direct group membership
      indicates that the user is directly associated with the group and
      SHOULD indicate that clients may modify membership through the
      "Group" resource.  Indirect membership indicates that user
      membership is transitive or dynamic and implies that clients
      cannot modify indirect group membership through the "Group"
      resource but MAY modify direct group membership through the
      "Group" resource, which may influence indirect memberships.  If
      the SCIM service provider exposes a "Group" resource, the "value"

[rohe]

Yes, sub is the user. The client appears in client_id and possibly also in aud.

[c00kiemon5ter]

Note that RFC9068 is only a profile; ie, a flavour of a JWT access-token. It is not the only possible format and other profiles should be acceptable.

[rohe]

Interesting comment about profiles. I do agree we should allow more the one format.
Has to be configurable. Should be fairly simple to accomplish that.