I need to validate a token generated by a oauth .NET application using Apache oltu code:
OAuthClientRequest oAuthRequest = OAuthClientRequest
.tokenLocation("https://URL/idp/connect/identitytokenvalidation")
.setClientId("CLIENTID")
.setGrantType(GrantType.REFRESH_TOKEN)
.setParameter("token", oauthToken)
.setScope("openid info")
.buildQueryMessage();
OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());
OAuthAccessTokenResponse oAuthResponse = oAuthClient.accessToken(oAuthRequest, OAuth.HttpMethod.GET);
it seems to work fine because I'm getting a reply from the server (it confirms the token is valid or not valid) but it is not to be the expected reply. Our identity server is replying in this way:
auth_time=1439911238, exp=1439911599, sub=300a3657-62f4-4d34-8c60-2c8696780abe, null, null, at_hash=jb6EW9ZgDm60aL573No4sw, null, null, nbf=1439911239, null, null, idp=idsrv, null, iat=1439911239, null, amr=password
but the OAuthAccessTokenResponse validator is raising an issue because it seems to expect an token, like this one:
{
"id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJub25jZSI6IjE0Mzk5MTIxNTI4MjMwLjM0NTUyOTg3MjkyNDA4OTQzIiwiaWF0IjoxNDM5OTEyMTUyLCJhdF9oYXNoIjoiWlItaGlwcGh6YUctSlhkVGRnZTZwQSIsInN1YiI6IjMwMGEzNjU3LTYyZjQtNGQzNC04YzYwLTJjODY5Njc4MGFiZSIsImFtciI6InBhc3N3b3JkIiwiYXV0aF90aW1lIjoxNDM5OTExMjM4LCJpZHAiOiJpZHNydiIsImlzcyI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwIiwiYXVkIjoiaGVhbHRoY29ubmVjdGVkcG9ydGFsIiwiZXhwIjoxNDM5OTEyNTEyLCJuYmYiOjE0Mzk5MTIxNTJ9.MwbkGL85MHookJxqPv9fgae9qZ4iMJiENrY-eaIkC1wqTLuCunpeyNfV88mQZtpkbF3dk8S4uEg2UhhnGjQb-16xFUBf2zujdOujTCPV622k1xrhe3Cs9zsyY0EF4R1wTpNs_kkuMnJgaIeAgzrFki9t6G2QKMrGlcnSPr_UVRhL5KAkX3aWDBDrDGMaDPBVVU8jYV-oK5S4NExFAayWm1d0wXraWVNVcCyRQMDvZB1Jh0rqNcNhMg8EPV0LngZYSqicvyMTKv2eryBVX7sT8MUEi56vgLm-2bl6YWAGcZKSShpmBR3vDMzuuLOiBE9TrSQeu01hWJZEpgAhBu5qsA",
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJjbGllbnRfaWQiOiJoZWFsdGhjb25uZWN0ZWRwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsImhyYXVzZXIiLCJkaGNpbmZvIiwiaHJhaW5mbyJdLCJzdWIiOiIzMDBhMzY1Ny02MmY0LTRkMzQtOGM2MC0yYzg2OTY3ODBhYmUiLCJhbXIiOiJwYXNzd29yZCIsImF1dGhfdGltZSI6MTQzOTkxMTIzOCwiaWRwIjoiaWRzcnYiLCJpc3MiOiJodHRwczovL3VhdC5tZWRpcmVzb3VyY2UuY29tL2hjL2lkcCIsImF1ZCI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwL3Jlc291cmNlcyIsImV4cCI6MTQzOTkxMjUxMiwibmJmIjoxNDM5OTEyMTUyfQ.DIqn3JaMziDQXSfAkGDyMT5Loa7HaNvhTnxywq5UTWnnqU6Zhu2yFgWvx73-i0W9ikX30askFmMKvPX0cKnVCFj2ri_jp-F4buJe2m1-3z_ZkMlX38zgthsaifbuvGACba2AlHutvxjhhsPnoTxa6R1qMsPGaEduhD6siPOtUFGFrGVqxOYssSHHX0EX2-AUj41dZTADnuInQwlWraaGPAJCLoCI3Ww1BY5wz9-5Eo6pfXtCZFABZL30TVxfvsXZaTrPWgw-WjhEnG0otFtvVAtjN0z4N-0NhISu-dcoX2KhOU26ckp1XC9xiK8sP-6OC0Bf-1Ecrep3Y_uDCOnBRw",
"token_type": "Bearer",
"expires_in": "360",
"scope": "openid info",
"state": "14399121528230.34552987292408943",
"session_state": "1hTuAWL5A_Aj-sGFjpFACF4OI-gnyUEgnxcvImTavtw.0fb69b197f167119b7ab2362882938d8"
}
Any clue on that? The url to validate the token is using a GET so to be able to send the call using this method I need to accept as reply OAuthAccessTokenResponse.
Am I missing something?
Andrea
The way in which OAuth 2.0 tokens can be validated is not standardized. Work is underway to do that: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-introspection-11 This means that your validation implementation is just not compatible with your identity server.
Edit: this work was standardized in https://www.rfc-editor.org/rfc/rfc7662