Apache oltu Oauth2 token validation

Question

I need to validate a token generated by a oauth .NET application using Apache oltu code:

OAuthClientRequest oAuthRequest = OAuthClientRequest                        
.tokenLocation("https://URL/idp/connect/identitytokenvalidation")
.setClientId("CLIENTID")        
.setGrantType(GrantType.REFRESH_TOKEN)
.setParameter("token", oauthToken)
.setScope("openid info")
.buildQueryMessage();

OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());

OAuthAccessTokenResponse oAuthResponse = oAuthClient.accessToken(oAuthRequest, OAuth.HttpMethod.GET);

it seems to work fine because I'm getting a reply from the server (it confirms the token is valid or not valid) but it is not to be the expected reply. Our identity server is replying in this way:

auth_time=1439911238, exp=1439911599, sub=300a3657-62f4-4d34-8c60-2c8696780abe, null, null, at_hash=jb6EW9ZgDm60aL573No4sw, null, null, nbf=1439911239, null, null, idp=idsrv, null, iat=1439911239, null, amr=password

but the OAuthAccessTokenResponse validator is raising an issue because it seems to expect an token, like this one:

{
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJub25jZSI6IjE0Mzk5MTIxNTI4MjMwLjM0NTUyOTg3MjkyNDA4OTQzIiwiaWF0IjoxNDM5OTEyMTUyLCJhdF9oYXNoIjoiWlItaGlwcGh6YUctSlhkVGRnZTZwQSIsInN1YiI6IjMwMGEzNjU3LTYyZjQtNGQzNC04YzYwLTJjODY5Njc4MGFiZSIsImFtciI6InBhc3N3b3JkIiwiYXV0aF90aW1lIjoxNDM5OTExMjM4LCJpZHAiOiJpZHNydiIsImlzcyI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwIiwiYXVkIjoiaGVhbHRoY29ubmVjdGVkcG9ydGFsIiwiZXhwIjoxNDM5OTEyNTEyLCJuYmYiOjE0Mzk5MTIxNTJ9.MwbkGL85MHookJxqPv9fgae9qZ4iMJiENrY-eaIkC1wqTLuCunpeyNfV88mQZtpkbF3dk8S4uEg2UhhnGjQb-16xFUBf2zujdOujTCPV622k1xrhe3Cs9zsyY0EF4R1wTpNs_kkuMnJgaIeAgzrFki9t6G2QKMrGlcnSPr_UVRhL5KAkX3aWDBDrDGMaDPBVVU8jYV-oK5S4NExFAayWm1d0wXraWVNVcCyRQMDvZB1Jh0rqNcNhMg8EPV0LngZYSqicvyMTKv2eryBVX7sT8MUEi56vgLm-2bl6YWAGcZKSShpmBR3vDMzuuLOiBE9TrSQeu01hWJZEpgAhBu5qsA",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSIsImtpZCI6ImEzck1VZ01Gdjl0UGNsTGE2eUYzekFrZnF1RSJ9.eyJjbGllbnRfaWQiOiJoZWFsdGhjb25uZWN0ZWRwb3J0YWwiLCJzY29wZSI6WyJvcGVuaWQiLCJlbWFpbCIsImhyYXVzZXIiLCJkaGNpbmZvIiwiaHJhaW5mbyJdLCJzdWIiOiIzMDBhMzY1Ny02MmY0LTRkMzQtOGM2MC0yYzg2OTY3ODBhYmUiLCJhbXIiOiJwYXNzd29yZCIsImF1dGhfdGltZSI6MTQzOTkxMTIzOCwiaWRwIjoiaWRzcnYiLCJpc3MiOiJodHRwczovL3VhdC5tZWRpcmVzb3VyY2UuY29tL2hjL2lkcCIsImF1ZCI6Imh0dHBzOi8vdWF0Lm1lZGlyZXNvdXJjZS5jb20vaGMvaWRwL3Jlc291cmNlcyIsImV4cCI6MTQzOTkxMjUxMiwibmJmIjoxNDM5OTEyMTUyfQ.DIqn3JaMziDQXSfAkGDyMT5Loa7HaNvhTnxywq5UTWnnqU6Zhu2yFgWvx73-i0W9ikX30askFmMKvPX0cKnVCFj2ri_jp-F4buJe2m1-3z_ZkMlX38zgthsaifbuvGACba2AlHutvxjhhsPnoTxa6R1qMsPGaEduhD6siPOtUFGFrGVqxOYssSHHX0EX2-AUj41dZTADnuInQwlWraaGPAJCLoCI3Ww1BY5wz9-5Eo6pfXtCZFABZL30TVxfvsXZaTrPWgw-WjhEnG0otFtvVAtjN0z4N-0NhISu-dcoX2KhOU26ckp1XC9xiK8sP-6OC0Bf-1Ecrep3Y_uDCOnBRw",
  "token_type": "Bearer",
  "expires_in": "360",
  "scope": "openid info",
  "state": "14399121528230.34552987292408943",
  "session_state": "1hTuAWL5A_Aj-sGFjpFACF4OI-gnyUEgnxcvImTavtw.0fb69b197f167119b7ab2362882938d8"
}

Any clue on that? The url to validate the token is using a GET so to be able to send the call using this method I need to accept as reply OAuthAccessTokenResponse.

Am I missing something?
Andrea

Community · Accepted Answer · 2021-10-07 11:21:20Z

1

The way in which OAuth 2.0 tokens can be validated is not standardized. Work is underway to do that: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-introspection-11 This means that your validation implementation is just not compatible with your identity server.

Edit: this work was standardized in https://www.rfc-editor.org/rfc/rfc7662

edited Oct 7, 2021 at 11:21

CommunityBot

11 silver badge

answered Aug 18, 2015 at 16:45

Hans Z.

54.6k12 gold badges114 silver badges123 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Turtle Over a year ago

The validation of a token has now been standardized, maybe you should update your answer since it's the accepted one ;)

Collectives™ on Stack Overflow

Apache oltu Oauth2 token validation

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related