In OAuth2, is the /introspect endpoint meant for the OAuth Client to call, or the OAuth Resource Server to call?

user_2668666 0
Viewed 707

I'm learning about the OAuth /introspect endpoint as a means to validate an Access Token. I'm using Okta, which I think is relevant to the question.

I've read online that the /introspect endpoint is intended to be called by an OAuth Resource Server (for example, an OAuth Client would call a Resource Server, providing an Access Token, and the Resource Server would call the /introspect endpoint to make sure the token is valid).

However, the /introspect endpoint (at least with Okta) requires you to provide the OAuth Client credentials (either as a basic auth header, or in the case where there is no client secret, just a client_id request param).

So, how can the Resource Server call the /introspect endpoint when it doesn't have the OAuth Client ID and/or secret? This is making me wonder if the /introspect endpoint is meant to be called by the OAuth Client instead, which to me, doesn't seem as useful.

okta oauth-2.0 openid-connect oauth
3 Answers

Please refer to this article. Resource server needs to be a registered client application at Okta and client credentials in /introspect refer to this client's.

user_76230480

Based on my understanding the introspection endpoint is meant to be called by an API resource.

This endpoint is used by the API resource in order to validate the bearer token provided with an incoming HTTP request issued by a client application.

Most of the times this happens when the provided bearer token is a reference token, so the API resource server needs to known whether the provided reference token is associated with a valid access token. This information must be asked to the secure token server via a call to the introspection endpoint.

You can find more information here in the identity server docs. Identity server is a .NET implementation of the openid connect protocol, which is based itsel on oauth2.

This is a documentation that shows you how to call the introspection endpoint programmatically. This documentation is specific for a .NET library called identity model, but this is not relavant for your question, because the library simply implements the protocol.

As you can see in the example of the linked documentation, the client id that you need to specify when you call the introspection endpoint is simply the name of the API resource. The client secret is the API resource secret that you have defined for your API resource.

So, the source of your confusion is simply a terminology overload. In the context of the call to the introspection endpoint both of the following equations hold true:

  • client id == API resource name
  • client secret == API resource secret

This docs confirm both of my assumptions.

user_43316370

If it helps here are a few resources of mine, to add to Enrico's answer:

  • API Setup - see step 6 - you have to register an OAuth Client for the API

  • API OAuth Messages - see steps 16, 17 and 19 for the three types of response your API needs to deal with

  • API Code - for an example implementation in NodeJS

user_90198850
Related