Introspection uri

As explained in Spring Security in Action, Second Edition

An introspection endpoint is an OAuth endpoint that accepts requests to validate a token and return its associated metadata.

An introspection URI lets a resource server ask an authorization server whether an access token is valid and retrieve metadata needed for authorization. section 15.5

Configure opaque-token validation with three values:

• The authorization server’s introspection URI. section 15.3
• The resource server client ID and secret, used to authenticate the introspection request. section 15.3
• Spring Security’s opaqueToken() configuration, which connects the URI and credentials to the resource server. section 15.3

Spring Security configuration

Set introspectionUri, resourceServerClientID, and resourceServerSecret from properties, then pass them to opaqueToken(). Require authentication with anyRequest().authenticated(). section 15.3

Figure 15.6 Token introspection. In situations where the resource server cannot depend on signature-based validation of access tokens (such as when token revocation is necessary), or when the token does not contain detailed information (as with opaque tokens), the resource server is required to make inquiries to the authorization server. This is done to ascertain the validity of a token and to gather additional information about it.

Token introspection is required when tokens are opaque or when authorization-server revocation must be recognized, including for otherwise non-opaque tokens. section 15.3

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains required properties and Spring Security wiring, but defers the introspection protocol’s response details.

Examples

Uses a localhost authorization server, a port-9090 resource server, client-credentials registration, and a protected /demo endpoint.

What it assumes

Assumes an authorization server exposing introspection and registered resource-server credentials, while demonstrating property injection and security configuration.

What you can do after

Configure Spring Security to authenticate requests through an authorization server’s introspection endpoint.

How it connects

Connects OAuth 2 resource servers, authorization servers, opaque tokens, JWTs, client credentials, and token revocation.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• revocationused by · Revocation is the invalidation or withdrawal of a previously issued credential, key, certificate, token, or permission before or when its authorization ends.
• opaque tokenused by · An opaque token is an access token whose contents are not directly interpretable by its recipient, typically requiring server-side validation or lookup.
• resource serverused by · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.
• client credentialused by · A client credential is secret or otherwise verifiable information that identifies an OAuth client to an authorization system.
• token introspectionpart of · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
• endpointkind of · An endpoint is a network-accessible address or interface through which a service exposes a resource or operation and handles requests and responses.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.